Senior Product Security Engineer (Cybersecurity)

Location: Remote in Brazil

Compensation: $50K–$60K annually

Company

hirify.global develops a software platform supported by product and platform engineering teams.

What you will do

• Partner with developers throughout the SDLC to embed security into product development.
• Lead security design and architecture reviews and conduct threat modeling for new features and services.
• Perform penetration testing of web applications and APIs and turn findings into prioritized remediation work.
• Conduct secure code reviews and help define secure-coding standards and security acceptance criteria.
• Operate and tune SAST, DAST, dependency, and supply-chain scanning tools.
• Contribute security evidence and rigor to SOC 2, ISO 27001, and similar compliance programs.

Requirements

• Strong professional experience in product or application security.
• Hands-on penetration testing experience with web applications and APIs.
• Deep knowledge of modern web applications, authentication and authorization, sessions, OAuth 2.0, OpenID Connect, and OWASP Top 10 risks.
• Experience with security design reviews, threat modeling, and integrating security into the SDLC.
• Strong communication skills for explaining security risks and remediation steps to developers.
• Must be able to work remotely from Brazil.

Nice to have

• Experience with OWASP ZAP, Burp Suite Community Edition, Semgrep, Trivy, Grype, or Nuclei.
• OSCP or another relevant offensive-security certification.
• Cloud security experience with AWS, Azure, or GCP, plus container or Kubernetes security.
• Experience supporting SOC 2, ISO 27001, or similar programs.
• Experience in enterprise or regulated environments.

Culture & Benefits

• Remote contract role based in Brazil.
• Collaborative security partnership with product and platform engineering teams.
• Security is embedded early in development rather than applied only before release.
• Success is measured through practical security processes, clear remediation paths, and early developer engagement.