Apply

Ready to go for it?

AI Apply speeds things up—apply directly if you prefer.

FREE ACCESS
5,000–10,000 jobs/day
Scoutfield Logo

See all jobs on Scoutfield

Search thousands of fresh jobs every day.

Discover
  • Fresh listings
  • Fast filters
  • No subscription required
Create a free account and start exploring right away.
Pagaleve

Senior Blue Team Analyst – Incident Response, Cloud Security

Pagaleve

. Lead the technical response to incidents, from triage through containment, eradication, and post-mortem analysis .

Posted 11/9/2026contractRemote • BrazilSeniorWebsite

Core Competencies

Role fit
Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response and AWS security, with a strong focus on automation, tool development, and compliance with Central Bank regulations. Proven ability to lead technical investigations and enhance security postures through effective use of infrastructure as code and detection engineering.

Highest-signal resume keywords
Incident Response LeadershipAWS Security ExpertisePython ProgrammingAutomation DevelopmentDetection Engineering

ATS Keywords

Tailor your resume
Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills
Incident ResponseAWS SecurityPythonGoTypeScriptInfrastructure as CodeDetection EngineeringForensicsAutomationCloud Security
Soft Skills
AutonomyProblem-SolvingCommunication
Tools & Technologies
CloudTrailGuardDutyTerraformKubernetesEDRSAMLOIDCAI Coding AssistantsVPC Flow LogsSecurity Hub
Certifications & Qualifications
AWS Security SpecialtyGCIHGCFA
Industry Keywords
FintechCentral Bank RegulationsPayment InstitutionSecurity ArticlesOpen-Source Projects

Tech Stack

Tools & technologies
AWSCloudCyber SecurityKubernetesOpen SourcePythonTerraformTypeScriptGo

About the role

Key responsibilities & impact
  • Lead the technical response to incidents, from triage through containment, eradication, and post-mortem analysis
  • Conduct investigation and forensics across AWS environments, endpoints, and identity systems using CloudTrail, GuardDuty, VPC Flow Logs, and IdP logs
  • Write and maintain playbooks and runbooks, turning repetitive tasks into automation
  • Support incident communications required by Central Bank regulations
  • Strengthen AWS security posture through IAM and least privilege, just-in-time access, WAF, network segmentation, and secrets management
  • Review and write secure IaC (Terraform or equivalent) alongside SRE and engineering teams
  • Create and tune detections for cloud threats, measuring false-positive rates and coverage
  • Develop internal tools and agents to automate triage, alert enrichment, and response
  • Treat every tool as a product, with a clear problem, defined user, success metric, and iterative development
  • Share what you build to raise the team’s technical bar
  • Work with the engineering team to address cloud security challenges and serve as a technical reference for incident response
  • Build detections, automations, and internal products that measurably reduce response times and risk
  • Use AI-assisted coding to deliver in weeks what previously took quarters
  • Report to the Head of Cyber Security

Requirements

What you’ll need
  • Proven experience leading real-world incident response—not just laboratory exercises
  • Proven experience securing AWS in production, including IAM, CloudTrail, GuardDuty, Security Hub, VPC, and KMS
  • Daily programming in Python, Go, or TypeScript, with your own code running in production
  • Fluent use of AI for development, including coding assistants, agents, and LLMs via API
  • Track record of building something—a tool, automation, or product—and measuring the results it delivered
  • Autonomy to take a problem from diagnosis through delivery without needing someone to drive the process
  • Preferred: experience in fintech, a payment institution, or an environment regulated by the Central Bank
  • Preferred: detection engineering—rules as code (Sigma, KQL, SPL, or similar) and log pipelines
  • Preferred: infrastructure as code and Kubernetes
  • Preferred: endpoint and memory forensics; familiarity with EDR
  • Preferred: identity and SSO, including SAML, OIDC, and conditional access
  • Preferred: certifications such as AWS Security Specialty, GCIH, or GCFA
  • Preferred: open-source projects, security articles, or conference presentations

Benefits

Comp & perks
  • Contractor engagement model (PJ)
  • Competitive compensation
  • Health insurance with 100% coverage for the employee and 75% coverage for the first dependent
  • Birthday month day off
  • Monthly discount coupon for stores that accept Pix Parcelado
  • Fully remote work