Required skills
Job description
Contract Application Security Analyst (AppSec) needed in São Paulo (3–6 years, ideally 5+) to assess security of web apps, APIs, Android/iOS mobile and legacy client-server systems. You will run security assessments (SAST/DAST/code review), perform threat modeling and risk analysis, review architecture and security requirements, validate fixes, and guide dev
Project overview
Contract Application Security Analyst (AppSec) needed in São Paulo (3–6 years, ideally 5+) to assess security of web apps, APIs, Android/iOS mobile and legacy client-server systems. You will run security assessments (SAST/DAST/code review), perform threat modeling and risk analysis, review architecture and security requirements, validate fixes, and guide development teams on remediation and secure development best practices.
Strong knowledge of OWASP standards, authN/authZ protocols (OAuth2/OIDC/JWT/SAML), networking/crypto/TLS, and compliance (LGPD/PCI-DSS/ISO 27001) is required; cloud security and common AppSec tools are a plus.
Responsibilities
- Perform security assessments on web applications, APIs, mobile applications (Android and iOS) and applications
- Identify vulnerabilities and support development teams in defining corrective actions.
- Conduct reviews of architecture and security requirements for new systems and functionalities.
- Produce technical documentation and disseminate good practices for safe development.
Requirements
- Application Security (AppSec) experience (3+ years)
- Security assessments for web applications
- API security assessment
- Mobile application security assessment (Android and iOS)
- Security assessment of legacy client-server applications / hybrid environments
- Vulnerability identification and remediation support
- Architecture and security requirements review
- Secure code analysis / code review
- Security testing and fix validation
- Threat Modeling and application risk analysis
- OWASP Top 10
- OWASP API Security Top 10
- OWASP Mobile Top 10
- OWASP ASVS
- Authentication/authorization protocols: OAuth 2.0, OpenID Connect, JWT, SAML
- Networking fundamentals for security
- Cryptography fundamentals
- TLS and secure communication protocols
- Knowledge of compliance/security frameworks: LGPD, PCI-DSS, ISO 27001
- Familiarity with AppSec tools: SAST and DAST (and code review tooling/process)
Project details
- Start: flexible
- Remote: hybrid
- Location: Brazil, BR
Indexed by 9am's meta-search. You are a job provider? Claim or manage this listing
Found on ubique-systems.com