FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
Lead Engineer – AppSec
Chicago Career Tech. Serve as the technical security authority for Product and Engineering teams, integrating security early in the development lifecycle .
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in application security, including threat modeling, vulnerability management, and secure coding practices. Proficient in integrating security into CI/CD pipelines and ensuring compliance with standards such as LGPD, ISO 27001, and SOC 2.
Highest-signal resume keywords
Application SecurityThreat ModelingVulnerability ManagementCI/CD Security IntegrationOWASP Knowledge
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
Application SecurityThreat ModelingVulnerability ManagementSecure Coding PracticesJavaScriptTypeScriptInjection VulnerabilitiesAuthentication FailuresAccess Control IssuesSecurity Standards
Soft Skills
Strong Communication SkillsPartnership Building
Tools & Technologies
Burp SuiteOWASP ZAPSemgrepSonarQubeSnykGitHub ActionsJenkinsAWSKubernetesTerraform
Certifications & Qualifications
OSCPOSWECSSLP
Industry Keywords
LGPDISO 27001SOC 2SaaSMicroservices
Tech Stack
Tools & technologiesAWSJavaScriptJenkinsKubernetesNode.jsTerraformTypeScript
About the role
Key responsibilities & impact- Serve as the technical security authority for Product and Engineering teams, integrating security early in the development lifecycle
- Lead threat modeling sessions for new features and architectural changes
- Conduct security code reviews and manual testing of web applications, APIs, and mobile applications
- Implement, maintain, and tune SAST, DAST, SCA, and secret detection tools in CI/CD pipelines
- Triage, prioritize, and track vulnerabilities, supporting developers with remediation
- Define secure development standards and guidelines covering authentication, authorization, encryption, and personal data
- Promote a security culture through training
- Support LGPD, ISO 27001, and SOC 2 compliance initiatives
- Participate in incident response involving applications
- Assess the current application security landscape, tools, vulnerability backlog, and product risks across Gupy
- Enhance SAST, SCA, and secret detection in pipelines for critical repositories, reducing false positives
- Implement triage and prioritization workflows with SLAs and remediation metrics
- Incorporate threat modeling into the development of higher-risk features
- Publish security standards and checklists for Engineering
- Conduct or coordinate penetration tests for critical applications and APIs, with remediation plans agreed upon with the teams
Requirements
What you’ll need- Strong experience in application security or software development with a significant focus on security
- In-depth knowledge of the OWASP Top 10 and OWASP API Security Top 10
- Knowledge of injection vulnerabilities, XSS, IDOR, SSRF, authentication failures, and access control issues
- Ability to read and review code, preferably JavaScript/TypeScript (Node.js)
- Hands-on experience with Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, or similar tools
- Experience integrating security checks into CI/CD pipelines, such as GitHub Actions and Jenkins
- Knowledge of OAuth 2.0, OpenID Connect, and JWT
- Experience with vulnerability management, triage, criticality-based prioritization, and remediation tracking
- Strong communication skills, with the ability to translate technical risks into business impact and build partnerships with Engineering teams
- Preferred: experience with AWS, container security, and Kubernetes
- Preferred: knowledge of Terraform for infrastructure-as-code security
- Preferred: experience with threat modeling in microservices architectures
- Preferred: OSCP, OSWE, CSSLP, or equivalent certifications
- Preferred: knowledge of LGPD, ISO 27001, and SOC 2
- Preferred: experience at SaaS companies handling large volumes of personal data
Benefits
Comp & perks- Meal allowance on a Caju card
- Medical plan fully funded by Gupy for you, with copayments for eligible dependents
- Dental plan
- Life insurance
- Home office allowance
- Physical wellness support through Wellhub and TotalPass
- Starbem, an online telemedicine and wellness service, including an initial complimentary offer of four psychology sessions, one nutrition session, and medical consultations
- Guapeco, a pet health plan with reimbursement at any veterinary clinic in Brazil
- Six months of maternity leave
- Extended paternity leave
- Parental leave policy applicable to same-sex couples, non-gestational mothers, and adoption cases
- Five days of marriage leave
- Internal recognition through Gupy Coins, redeemable as credit on a Caju card
- Birthday day off
- Creditas payroll-deducted loan
- Creditas financial education
- Creditas Store
- Férias&Co, providing annual travel credits with part of the monthly fee subsidized
- Opportunity to become a Gupy shareholder
- Career paths with management and technical-track options
- Learning, challenging assignments, and promotion opportunities