Staff Security Engineer – AppSec
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Arquiteto AppSec definindo padrões e controles para proteger aplicações, APIs e sistemas com LLMs da Stone, empresa brasileira de tecnologia e serviços financeiros.
Responsibilities:
- Define security architecture standards with Engineering and Product teams, including for applications with LLMs, agents, and RAG pipelines
- Create architectural plans for new systems and technical migration roadmaps for legacy systems
- Identify vulnerabilities, assess risks, and help prevent attacks
- Participate in security incident analysis and response
- Train and raise awareness among development teams about best practices and the safe use of AI assistants
- Define and implement security strategies for applications using LLMs and generative AI
- Integrate security practices from the beginning of the software development lifecycle
- Conduct architecture, code, and design reviews
- Define guardrails and standards for LLM risks, such as prompt injection, insecure output handling, data leakage, excessive agency, and denial-of-wallet
- Establish guidelines for the safe use of AI-assisted development tools
- Develop security standards and best practices
- Provide technical security guidance and training
- Use and understand automated validation tools in CI/CD, such as SAST, DAST, SCA, and Secret Scanning
- Monitor threat trends, including threats to AI systems
- Develop solutions to complex security challenges
- Hunt for threats in corporate and production environments
Requirements:
- Bachelor's degree, completed or in progress, in Information Security, Computer Science, Information Systems, Software Engineering, or a related field
- Knowledge of common attack vectors
- Experience conducting threat modeling
- Experience with effective protection mechanisms for APIs and mobile applications
- Knowledge of fundamental Cloud security services and concepts (AWS, Azure, or GCP)
- Familiarity with security risks in applications that use LLMs and generative AI, including the OWASP Top 10 for LLM Applications and MITRE ATLAS
- Ability to identify opportunities for improvement, new solutions, and alerts
- Influencing and negotiation skills to guide teams
- Ability to work autonomously
- Concise, candid, and assertive communication, with the ability to translate complex problems into accessible language
- Proactive in seeking or requesting information
- Ability to work effectively on multidisciplinary teams using agile methodologies
- Ability to read and communicate in English
- Experience participating in incidents and identifying root causes (a plus)
- Experience with projects subject to financial-sector requirements, such as Bacen, PCI, and SOX (a plus)
- Strong programming skills (a plus)
- Hands-on experience with threat modeling and controls for LLM applications in production (a plus)
- Experience securing APIs that expose AI models (a plus)
- Experience developing policies and controls for the enterprise use of generative AI tools (a plus)
- Knowledge of the NIST AI RMF and ISO/IEC 42001 (a plus)
Benefits:
- Base salary
- Variable compensation package (profit sharing, long-term incentive plan, or commission), depending on role eligibility
- Health and dental insurance with co-payments
- Hospital Virtual Verde: telemedicine team available 24 hours a day, 7 days a week
- Medication allowance
- Meal and/or food allowance – Pluxee
- Childcare assistance for children up to 5 years and 11 months old
- Assistance for employees with children with disabilities
- Life insurance
- Fuel allowance or commuting assistance
- Home office allowance for hybrid or remote contracts
- Welcome kit for new parents
- SESC partnership
- Education benefit: in-house self-development platform (Studa and Stone Library)
- Acolhe360°: free emotional support
- Quick massage and on-site clinic
- Optional benefits: Wellhub, TotalPass, Pet Club, Flash, Férias&Co, transportation vouchers, Allya, and educational partnerships
Similar Jobs
CISO/VP, Data Security
CISO/VP Data Security owning cybersecurity, controls, vendor risk, and regulatory readiness. Protecting a fast-growing fintech and cryptocurrency company while advising leadership and regulators.
Senior Security Engineer
Security Engineer securing Pair Team’s AI-enabled healthcare and Medicaid platform. Building cloud, application, AI, and compliance controls for whole-person care.
System Director – Facilities, Security, Asset Management
System Director overseeing facilities, safety, security, assets, vendors, and regulatory compliance for Emerus small-format hospitals. Leading enterprise operations, emergency preparedness, and recall management.
IT Security Consultant
IT Security Consultant advising Evonik, a global specialty chemicals company, on information security, risk management, and M&A security assessments. Home-office role in Brazil.
Information Security Expert
Information Security Expert strengthening CREALOGIX’s digital banking and financial technology security. Developing ISMS, managing audits, assessing risks, and advising technical and business stakeholders.
Information Security Officer
Information Security Officer leading Vektor Group’s BSI-based ISMS, ISO 27001 certification, and NIS-2 compliance. Securing AI platforms built for defence and government customers.
IT Security Architect – IAM, On-Premises
IT Security Architect defining IAM, Active Directory, Entra ID, and on-prem security standards. Advising technical teams at sports nutrition company The Quality Group.
IT Security Architect – IAM, On-Premises
IT-Security-Architekt für IAM, Active Directory und On-Prem-Infrastruktur bei Sporternährungsanbieter The Quality Group. Entwicklung von Sicherheitsstandards und Beratung technischer Teams.
Cybersecurity Consultant
Consultant cybersécurité chez Wavestone, cabinet international accompagnant les transformations stratégiques. Intervention sur gouvernance, cloud, audits, risques et sécurité des systèmes.
Founding Information Security Lead
Founding Information Security Lead owning security, compliance, and IT operations for Flodesk’s email marketing platform. Building SOC 2, ISO 27001, and CCPA readiness.
Cybersecurity Architect
Cybersecurity Architect leading RMF, risk mitigation, and ATO efforts for DoD Zero Trust systems. GDIT delivers technology and mission services to U.S. government, defense, and intelligence agencies.
Senior Security Agent / AI Red Team Engineer
AI red-team engineer attacking PGTEK agents and converting findings into durable controls. Supporting secure Federal and DoD systems through threat modeling, remediation, and authorization activities.
Software Security Lead
Software Security Lead securing Cisco’s enterprise IT and Operations platforms across applications, cloud, identity, data, and AI. Leading threat modeling, architecture reviews, risk remediation, and security metrics.
Staff Security Researcher
Staff Security Researcher conducting vulnerability research and penetration testing for GitLab’s AI-powered DevSecOps platform. Developing attack methodologies, tooling, and security improvements.
Software Security Lead
Cisco software security lead securing AI-enabled enterprise platforms and applications. Leading threat modeling, architecture reviews, risk remediation, and portfolio security metrics.
Principal Security Researcher
Principal Security Researcher securing GitLab’s AI-powered DevSecOps platform. Leading vulnerability research, AI attack analysis, penetration testing, and remediation across GitLab’s codebase.
Application Security Remediation Engineer
Application Security Remediation Engineer remediating Wiz findings across enterprise applications for Arctiq’s technology services clients. Securing code, dependencies, containers, and DevSecOps delivery pipelines.
Senior Engineer, Information Security Architect
Information Security Architect engineering secure platforms and enterprise designs for Lovesac, a fast-growing adaptable furniture company. Leading Zero Trust architecture, security tooling, integrations, and governance.
Senior Security Engineer – Identity and Access Management
Senior IAM Security Engineer designing automated identity controls for Providence, a comprehensive healthcare organization. Modernizing hybrid identity infrastructure toward Zero Trust and cloud security.
Cybersecurity Engineer
Cybersecurity Engineer managing endpoint, identity, cloud, and enterprise security for Accela’s cloud-based government software platform. Supporting vulnerability management, compliance controls, investigations, and security automation.