3 months ago
Remote, BrazilSenior / Staff+
H1B Sponsor
Responsibilities
- Own threat modeling for platform APIs, risk decisioning systems, event-ingestion systems, and agentic AI products.
- Design, implement, and deploy authentication, authorization, and RBAC across the platform.
- Build the AppSec program, including SAST, SCA, secret scanning, IaC scanning, and container scanning.
- Develop LLM security guardrails for prompt injection, output validation, cost monitoring, and abuse monitoring.
- Drive security incident processes, vulnerability triage, and responsible disclosure.
- Maintain SECURITY.md and a threat registry while promoting secure-by-default engineering patterns.
- Partner with IT on incident response, access reviews, and audit evidence collection.
- Collaborate with product and engineering teams to embed security early in feature design.
Requirements
- 5+ years of software engineering experience, including the last 3+ years focused on application or product security.
- Strong software engineering fundamentals and hands-on Java and/or Python code review skills.
- Experience with SSO, SAML, OAuth 2.0, JWT, mTLS, JOSE, multi-tenant authorization, and PII handling/tokenization.
- Working knowledge of AWS security primitives including IAM, KMS, Secrets Manager, and VPC, plus Kubernetes experience.
- Experience providing technical evidence and controls for SOC 2, PCI, or ISO 27001 audits is preferred.
- Experience building or tuning SAST rules with Semgrep or CodeQL is preferred.
- OSCP, CISSP, or a meaningful bug-bounty track record is preferred.
Benefits
- Competitive salary and stock options are offered, with no specific compensation amount stated.
- 100% of Medical/Dental coverage for the employee and dependents.
- 100% Life/LTD coverage through Prudential.
- Monthly meal allowance through a Caju Card.
- Remote-first work arrangement.
- Family-friendly culture with regular team events and offsites.
- Professional development opportunities.
Tech Stack
Categories
About Oscilar
Oscilar powers real-time risk decisioning across fraud, credit, and compliance with a single, unified solution. Our no-code AI Risk Decisioning™ platform leverages agentic AI and advanced signal processing to analyze complex data, detect anomalies, and automate mission-critical decisions with speed and precision. Built by the team behind risk systems at Google, Meta, Uber, Citi, and J.P. Morgan, Oscilar combines deep technical expertise with cloud-native architecture to deliver scalability, transparency, and regulatory-grade performance.