Job Overview
Location
Brazil - Remote
Job Type
Full-time
Category
Security Engineer
Date Posted
May 17, 2026
Full Job Description
đź“‹ Description
- • Own and lead threat modeling across core platform APIs, risk decisioning systems, and agentic AI products, ensuring secure design patterns are embedded from inception.
- • Design, implement, and deploy comprehensive authentication and authorization systems—including user and API-level RBAC—scaling secure access controls across a multi-tenant SaaS architecture.
- • Stand up the company’s first AppSec program from the ground up by integrating SAST (Semgrep), SCA (Dependabot/Snyk), secret scanning, IaC scanning (Pulumi), and container scanning (EKS) into the CI/CD pipeline.
- • Build and enforce security guardrails around LLM and agent-based systems, including prompt-injection defenses, output validation, and monitoring of cost anomalies and abuse patterns on Bedrock, Anthropic, and OpenAI APIs.
- • Establish and manage the end-to-end security incident response process, including vulnerability triage, responsible disclosure workflows, and coordination with cross-functional teams.
- • Author and maintain SECURITY.md documentation, curate a living threat registry, and champion secure-by-default configurations across all engineering teams.
- • Partner with IT on corporate and product incident response, conduct regular access reviews, and collect audit evidence for compliance frameworks.
- • Collaborate proactively with product and engineering teams during feature design to embed security early, avoiding gatekeeping and enabling rapid, secure innovation.
- • Stay current with evolving security standards including OWASP, MITRE ATT&CK, and emerging LLM/agent security guidance, translating them into actionable engineering practices.
- • Implement and maintain secure data-handling practices for PII, including tokenization and encryption strategies across distributed systems.
- • Harden multi-tenant isolation controls to prevent data leakage and unauthorized cross-tenant access in high-volume, real-time risk decisioning systems.
- • Integrate and tune security tooling for Java and Python codebases, conducting rigorous PR reviews to identify and remediate vulnerabilities before deployment.
- • Ensure infrastructure-as-code (Pulumi) and Kubernetes (EKS) environments are secured using AWS primitives including IAM, KMS, Secrets Manager, and VPC configurations.
- • Drive adoption of secure development practices by mentoring engineers, creating internal documentation, and leading security-awareness initiatives.
- • Work remotely as part of a fully distributed team, coordinating across time zones to deliver security solutions that protect global financial transactions and AI-driven risk decisions.
🎯 Requirements
- • 5+ years of software engineering experience, with 3+ years focused on application or product security, preferably in fintech or data-heavy SaaS environments
- • Strong hands-on proficiency in Java and/or Python code review and vulnerability identification within PRs
- • Experience implementing SSO, SAML, OAuth 2.0, JWT, mTLS, JOSE, and multi-tenant authorization models with PII handling and tokenization
- • Working knowledge of AWS security services (IAM, KMS, Secrets Manager, VPC) and Kubernetes (EKS)
🏖️ Benefits
- • Competitive salary offered under CLT employment contract in Brazil
- • Stock options as part of compensation package
- • 100% coverage for Medical and Dental insurance (Care Plus) for employee and dependents
- • 100% coverage for Life and Long-Term Disability insurance (Prudential)
- • Monthly meal allowance via Caju Card
- • Remote-first culture with flexible work arrangements
- • Family-friendly environment with regular team events and offsites
- • Unparalleled opportunities for professional development and learning
Skills & Technologies
Python
Java
AWS
Kubernetes
OAuth
Senior
Remote
About Oscilar Inc.
Oscilar provides a no-code risk decisioning platform that enables fintechs and banks to build, test, and deploy real-time fraud prevention and credit risk models. The system centralizes identity, transaction, and alternative data, applies machine-learning rules, and offers continuous monitoring and explainable decisions. It is designed for product managers and analysts to reduce charge-offs, false positives, and manual reviews without engineering support.
Get more remote jobs like this
Subscribe to the weekly newsletter for similar remote roles and curated hiring updates.
Newsletter
Weekly remote jobs and featured talent.
No spam. Only curated remote roles and product updates. You can unsubscribe anytime.
