Senior Application Security Engineer

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Application Security Engineer based in Brazil. Join a collaborative, globally distributed engineering environment where application security is built directly into the software development lifecycle. In this hands-on role, you will go beyond identifying vulnerabilities to implementing fixes and helping engineering teams deliver more secure applications. You will strengthen security practices across codebases, repositories, and CI/CD pipelines while improving the effectiveness of automated security tools. Working closely with developers, you will help prioritize risks, resolve findings, and embed secure coding practices into everyday workflows. This opportunity is ideal for a technically strong professional who combines software development expertise with practical application security experience. You will contribute to large-scale international projects while supporting a culture of continuous improvement and security ownership.

Investigate and remediate application security vulnerabilities directly in the code, implement fixes, and submit pull requests for review. Deploy, configure, maintain, and optimize Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools across repositories and CI/CD pipelines. Tune security rules, reduce false positives, and improve the accuracy and effectiveness of automated security scanning. Triage and prioritize findings from security scanners, dependency analyses, and penetration tests, working with engineering teams to ensure issues are resolved. Review pull requests and application designs to identify potential security weaknesses and recommend practical improvements. Develop and share secure coding guidelines, helping developers understand vulnerabilities and apply effective remediation strategies. Collaborate with distributed teams while maintaining availability during US business hours. Requirements: Strong software development experience with Python and Go , including the ability to write production-quality code, implement fixes, and open pull requests. Hands-on application security experience, particularly in identifying and remediating vulnerabilities related to the OWASP Top 10, vulnerable dependencies, exposed secrets, authentication, and session management. Direct experience deploying, configuring, and operating SAST and SCA tools within CI/CD pipelines, rather than simply reviewing their output. Solid understanding of secure software development practices, application security principles, and vulnerability management. Strong communication and collaboration skills, with the ability to explain security findings clearly and practically to software developers. Availability to work during US business hours. Experience in healthcare or another regulated industry is an advantage. Benefits: Comprehensive healthcare: Company-paid medical insurance and mental health programs. Sick leave: Five undocumented sick-leave days per year. Learning and development: Access to internal meetups, conferences, workshops, a Udemy license, language courses, and company-paid certifications. Paid time off: 20 working days of paid vacation, in addition to local bank holidays. Remote flexibility: 100% remote work arrangement. Career growth: Access to an internal mobility program that supports project changes and professional development. Global exposure: Opportunities to contribute to large-scale projects for international and fast-growing clients. Collaborative culture: A welcoming, informal environment with an open-door policy, experienced colleagues, and regular team-building activities. Long-term employment: An opportunity to build lasting expertise and grow within an international engineering environment.