Senior Software Engineer, Security Platform

Overview

Build and own the platform the security team runs on: services that discover, scan, triage and route security findings, the NATS-based event bus that connects them, and the CI security gates in GitLab pipelines. This is a development role on the security team, not a security-analyst role.

What you'll do

• Design, build, and operate security engineering services primarily in Golang and Python, on AWS and Kubernetes, including new services and the upkeep, hardening and retirement of existing ones.
• Own the event-driven platform between security services: the NATS bus, its contracts and consumers, delivery guarantees and observability.
• Integrate the platform end-to-end: scanners to finding system-of-record to tickets to metrics, so remediation state is visible and exam evidence is a by-product of engineering.
• Own delivery of the security gates (SAST, SCA, secret detection, container and IaC scanning): scanner selection and tuning, suppression workflow mechanics, false-positive burn-down, and rollout tooling from advisory to enforcing.
• Build agentic security workflows: CI review agents, automated finding triage and verification, remediation helpers that other engineers adopt.
• Build triage-to-remediation automation: validate true positives by hand, then automate reproduction context, fix guidance, and routing to owning teams and vulnerability-management operations.
• Participate in threat modeling and secure design reviews for the services and pipelines you own.
• Participate in the on-call rotation for the services you own.

What you'll need

• 6+ years of professional software engineering experience, including significant backend experience.
• Deployed significant changes to a production application in the past 30 days.
• Strong proficiency in Golang, plus working proficiency in Python.
• Hands-on experience building and operating event-driven or message-based systems (NATS, Kafka, or similar): contracts, idempotent consumers, replay, back-pressure.
• Hands-on experience building and operating CI/CD pipeline tooling (jobs, shared templates, runners).
• Hands-on web application security knowledge: the OWASP Top 10 in real code, able to find these issues, fix them, and encode detection so they stop recurring.
• Hands-on experience with SAST, SCA, and secret-scanning tooling (e.g., Semgrep, CodeQL, Snyk, Trivy, Grype, gitleaks), including tuning them to a signal-to-noise ratio developers will tolerate.
• Demonstrated AI-forward engineering: actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in development work today, and have built agentic workflows that other engineers adopted.
• Working knowledge of AWS and Kubernetes as deployment targets for the services you build.

Nice to have

• Experience in fintech, payments, BNPL, or consumer lending, especially with systems in cardholder-data or regulated scope.
• Working knowledge of PCI DSS and SOC 2 as they apply to software development and change management.
• Software supply-chain integrity: SBOM pipelines, dependency governance, artifact signing and provenance (Sigstore, SLSA).
• Familiarity with policy-as-code and admission control (OPA, Kyverno, conftest).
• Exposure to bug bounty or external vulnerability report triage.
• Experience with threat modeling at a system level.
• Experience building and operating CI/CD pipeline tooling at fleet scale on GitLab CI.

Details

• Fully remote role (Brazil).
• Compensation: $5,000 - $9,500 USD per month, gross, based on experience level.
• Full-time.
• Reports to the Director of Information Security.