Identify, assess, and mitigate vulnerabilities in web applications, APIs, and cloud infrastructure
Conduct security reviews of code (SAST/DAST) and CI/CD processes
Implement and monitor intrusion detection tools, SIEM, and incident response
Perform penetration testing (pentests) on Trakto's applications and environments
Ensure compliance with standards and regulations (LGPD, ISO 27001, SOC 2)
Create and disseminate security policies, processes, and best practices for engineering teams
Collaborate with product and infrastructure teams to apply Security by Design principles
Monitor emerging threats and proactively adapt security controls
Respond to customer due diligence inquiries.

3+ years of experience in information security or security engineering
Strong knowledge of web application security (OWASP Top 10, injection, XSS, CSRF, authentication)
Experience with cloud environments (GCP — required; Azure, AWS are a plus)
Familiarity with penetration testing and vulnerability analysis tools (Burp Suite, Nmap, Metasploit, etc.)
Knowledge of cryptography, authentication (OAuth2, JWT, SSO), and API security
Ability to communicate technical risks clearly to non-technical audiences
Certifications such as OSCP, CEH, CISSP, or equivalents
Experience with bug bounty programs or red team/blue team activities
Knowledge of DevSecOps and integrating security into CI/CD pipelines
Experience in SaaS companies or platforms with high user data volume
Intermediate or advanced English

Security Engineer – Cyber Security

Key skills