Brazil
Pavago
XP Inc.
Senior AppSec Analyst
Brazil
São Paulo, São Paulo, Brazil
TypeScriptPythonJavaAWSKubernetesC#Go
Automatic translation. Check the original.
About Us
XP Inc. is one of the largest independent financial institutions in Brazil, owning brands such as XP, Rico, Clear, XP Educação, and InfoMoney, among others. With over 4.6 million active clients and over R$ 1.1 trillion in assets under custody, it has been transforming the financial market for 25 years to improve people's lives.
With a strong culture guided by four values - Dream Big, Entrepreneurial Spirit, Customer Focus, and Open Mind - XP Inc. is always looking for the best talents who have the ambition to achieve the impossible.
🚀 About the Opportunity
We are looking for a Senior AppSec Analyst to strengthen our team and act in the protection of strategic applications and projects with high impact. In this role, you will be responsible for performing security analyses, identifying vulnerabilities, recommending and building technical and procedural controls, as well as ensuring that solutions are aligned with best practices and security standards. If you are passionate about secure development, have a hands-on and proactive profile to create and evolve AppSec controls, master APIs and system integrations, have knowledge in security applied to Artificial Intelligence and LLMs, and want to be part of a dynamic, innovative, and challenging environment, this is the perfect opportunity for you!
Learn more about our day-to-day on Instagram and LinkedIn.
Check out our reviews on Glassdoor.
🔍 What We're Looking For
Essential Prerequisites
- Solid experience in Application Security, acting in the security analysis of applications throughout the entire SDLC (Software Development Lifecycle);
- Experience with SAST, DAST, SCA, and Secret Scanning tools and processes (e.g., CodeQL, Sonatype, Dependabot, Snyk, Checkmarx);
- In-depth knowledge of the main application security references: OWASP Top 10 and OWASP ASVS;
- Ability to interpret and prioritize vulnerabilities, translating security risks into clear technical recommendations for development teams;
- Experience with security in cloud-native environments (containers, Kubernetes, serverless), preferably in Azure;
- Knowledge in DevOps with GitHub Actions, including creation and maintenance of workflows, custom actions, and integration of security tools in CI/CD pipelines;
- Proactive and hands-on profile for building AppSec controls, such as project deployment, automation scripts, guardrails, security-as-code policies, and pipeline integrations;
- Solid knowledge in RESTful APIs and system integrations, including API security (authentication, authorization, rate limiting, payload validation, OWASP API Security Top 10) and consumption of webhooks and SDKs for security process automation;
- Knowledge in Artificial Intelligence, LLMs, and applied security, including understanding the specific risks of language models (prompt injection, data leakage, jailbreaking, OWASP Top 10 for LLM Applications) and the ability to assess the security of solutions that use generative AI;
Differentiators
- Experience in AppSec in the financial market (BACEN, CVM regulations, PCI-DSS);
- Experience in configuring and operating Security Gates in CI/CD pipelines (GitHub Actions, Azure DevOps, Jenkins);
- Development in programming languages (e.g., Python, C#, Go, Java, TypeScript), with the ability to read, review, and write code for security automation, creation of internal tools, and source code level vulnerability analysis;
- Relevant certifications: GWEB, GWAPT, CEH, AWS/Azure Security Specialty, among other related ones.
- Advanced English for communication with partners, suppliers, and global security communities.
🎯 Challenges and Impact
- Perform security analyses on applications, APIs, and microservices, identifying vulnerabilities and proposing fixes aligned with secure development best practices;
- Structure and operate the AppSec program, including vulnerability management (SAST/DAST/SCA), alert triage, and remediation plan tracking;
- Conduct threat modeling and security reviews of software architectures, focusing on RESTful API security, authentication/authorization (OAuth 2.0, OpenID Connect, JWT), cryptography, and sensitive data protection;
- Proactively build and evolve AppSec controls, automating security processes, creating hardening scripts, policies as code, and native integrations in CI/CD pipelines;
- Develop integrations between security tools (SIEM, ticketing, dashboards, scanners) through APIs, webhooks, and SDKs, creating automated response and orchestration ecosystems;
- Assess the security of solutions based on Artificial Intelligence and LLMs, identifying risks such as prompt injection, data poisoning, sensitive data exposure, and hallucinations, and proposing specific controls for mitigation;
- Collaborate with DevOps and Engineering teams to integrate security into CI/CD pipelines in an automated and low-friction manner (shift-left);
- Guide developers through guidelines, training, and code reviews focused on secure coding practices and best practices in the development and consumption of APIs;
- Stay updated on emerging vulnerabilities, critical CVEs, new attack techniques, and trends in software security, APIs, and artificial intelligence;
⏳ Process Stages
- Initial screening: Resume analysis to verify suitability for the qualifications and requirements of the position.
- General tests: Assessment of cultural alignment with the Mindsight test and the Predictive Index logical reasoning test.
- Interview with the Recruitment team: Discussion about expectations regarding the position and professional goals.
- Technical assessment: Interview focused on the specific skills required for the role.
- Interview with leadership: A conversation to discuss your vision and how you can contribute to the team and the company.
- Interview with colleagues: Interaction with future peers to assess synergy and teamwork.
- Offer: Presentation of the job offer, including details on compensation and benefits.
Flexible In-Office Work Model
Our work model varies depending on the role, being fully in-office for business fronts and more flexible for other teams.
We follow a model with more frequent in-office presence, but always guided by flexibility and autonomy with the responsibility of our entrepreneurial culture.
Here at XP Inc., we value personal interactions and believe in using the office as a tool to enhance our work relationships.
*By proceeding with the application, you declare that you have read, understood, and agree to the Privacy Policy of Grupo XP Inc. and its suppliers and partners who support the selection process. Grupo XP Inc. may use artificial intelligence solutions to support the recruitment team during the process, which may involve the processing of your personal data for this purpose, in accordance with the principles of the General Data Protection Law and the Privacy Policy of Grupo XP Inc.
Benefits
Health and well-being
- Health plan
- Dental plan
- Wellhub (Gympass)
- Zenklub
- Life Insurance
- iFood Benefits (flexible meal and food voucher)
- Transportation Voucher
- New Value (benefits club)
- Parental leave: maternity of 6 months and paternity of 20 days.
- Childcare Assistance
Financial Life
- Exclusive Investment Funds
- Investment Advisory
- XP Visa Infinite Card with no annual fee
- Credit (payroll loans, home equity, real estate CCB, etc.)
More opportunities with one profile
Want to be considered for more roles without repeating the whole process? Create your profile and be found by companies using Nort.
Create my profile