Application Security Analyst (AppSec)

About the Position

We're looking for an experienced Application Security Analyst (AppSec) to join an enterprise-level environment and help strengthen application security throughout the Software Development Life Cycle (SDLC).

If you have a strong background in application security assessments, secure development practices, and vulnerability management, this is an opportunity to contribute to the security of complex applications and support development teams in building more secure solutions.

Responsibilities

• Conduct security assessments of web applications, APIs, Android/iOS mobile applications, and client-server systems.
• Identify vulnerabilities and collaborate with development teams to define and implement remediation measures.
• Review application architectures and security requirements for new systems and features.
• Perform secure code reviews, application security testing, and remediation validation.
• Conduct Threat Modeling and application risk assessments.
• Produce technical documentation and promote secure coding practices across development teams.
• Contribute to secure development standards and application security initiatives in a large enterprise environment.
• Support security assessments involving AI-based and agentic systems, including hardening and the implementation of appropriate guardrails.

Work Model

Hybrid - 3 days per week in the office (São Paulo - Zona Sul).

Requirements

• At least 3 years of professional experience in Application Security (AppSec), application penetration testing, or secure software development.
• Hands-on experience assessing web applications, APIs, mobile applications (Android/iOS), and client-server systems.
• Strong knowledge of security standards and frameworks, including OWASP Top 10, OWASP API Security Top 10, OWASP Mobile Top 10, and OWASP ASVS.
• Experience with authentication and authorization protocols such as OAuth 2.0, OpenID Connect, JWT, and SAML.
• Practical experience in Threat Modeling and application risk analysis.
• Solid understanding of networking, cryptography, TLS, and secure communication protocols.
• Experience with legacy client-server applications and hybrid environments.
• Knowledge of LGPD, PCI DSS, ISO 27001, and other security and compliance frameworks.
• Familiarity with application security testing tools and techniques, including SAST, DAST, and secure code review.
• Foundational knowledge of AI, Machine Learning, and agentic systems, including security hardening and guardrails.
• Technical English proficiency to review documentation and interact with vendors.

Nice to Have

• Knowledge of cloud security across Azure, AWS, Oracle Cloud Infrastructure (OCI), or Google Cloud Platform (GCP).
• Experience with tools such as Burp Suite, Checkmarx, Fortify, Veracode, SonarQube, or similar solutions.
• Familiarity with Jira, Confluence, or project management platforms.
• Basic knowledge of reverse engineering for mobile or desktop applications.

Additional Advantages

• Certifications such as CSSLP, GWAPT, GWEB, GMOB, OSWE, CISSP, or equivalent.
• Secure Code Review experience with applications developed in Java, .NET, Node.js, or Python.
• Experience assessing mobile application security using tools such as MobSF, Frida, Objection, or JADX.
• Experience acting as a technical reference, Security Champion, or internal Application Security consultant.
• Involvement in defining secure development standards and enterprise-wide Secure Software Development Life Cycle (SSDLC) programs.

Apply for this position

Apply here