Application Security and DevSecOps Engineer

About the role

Security is part of evolving the Web Digital Twin for pilots and for the use of AI with sensitive technical data. The scope includes authentication, authorization, access control, environment segregation, hardening, LGPD, logs, architecture review, penetration testing and operational security.

The person will work closely with development, DevOps, AI and product to reduce risk without blocking technical progress. The aim is to make security a continuous, testable and documented practice.

Main responsibilities

• Review the security architecture of the WDT, its APIs, authentication, authorization and permissions by user and asset.
• Define and operate secret management and rotation, secure configuration and environment hardening.
• Define DevSecOps practices in pipelines, code review, dependencies, security testing and environment segregation.
• Lead or coordinate penetration tests, resilience tests, LGPD review and control validation before pilots.
• Support security for AI, including access control for technical corpora, logs, traceability, abstention and responsible use of model APIs.
• Document risks, mitigation plans, evidence, acceptance criteria and operating limits.
• Work with QA and DevOps to turn security findings into recurring, verifiable tests.

Required qualifications

• Experience in web-application, API, cloud or DevSecOps security.
• Knowledge of authentication, authorization, access control, secret management and hardening.
• Familiarity with OWASP, code review, security testing and vulnerability analysis.
• Ability to work with development, infrastructure, QA and product teams.
• Sound technical documentation, clear communication of risk and pragmatic prioritization.
• Interest in engineering systems, sensitive data, digital twins and applied AI.

Preferred qualifications

• Experience with Azure, CI/CD pipelines, SAST/DAST, dependency management and security observability.
• Knowledge of LGPD, environment segregation, logging, audit and incident response.
• Background in security of LLMs, RAG, vector databases, model APIs or protection of technical data.
• Experience in industrial environments, engineering, critical infrastructure or B2B software.

Related technologies and tools

OWASP, SAST/DAST, Azure, CI/CD, secret management, logs, hardening, architecture review, penetration testing and API security.

Profile

We are looking for a direct, collaborative person with firm fundamentals. They should explain risk clearly, propose workable mitigation and create controls that teams can repeat.

How to apply

To apply, send the following materials:

How do you currently use artificial-intelligence tools in your professional workflow? Name the tools, give examples of activities, and explain how you validate the results produced with AI assistance.

Additional information may include LinkedIn, GitHub, Behance, Google Scholar, articles, publications, websites, demonstrations, applications or other links relevant to the role.

• An up-to-date curriculum vitae with education, professional experience, main projects, technologies used and responsibilities held.
• A portfolio with concrete examples of previous work. For software, this may be GitHub, applications, systems, APIs, interfaces or projects that can be demonstrated. For engineering, this may be models, simulations, reports, analyses, publications or technical work that can be shared. Confidential projects may be presented in anonymized form.
• A presentation video of up to 5 minutes, briefly showing a project or portfolio, the problem solved, your contribution, the technologies used, your working workflow, everyday tools, your use of artificial intelligence and how you validate results produced with AI support.