Senior Security Engineer - Blue Team

Role overview

Strengthen a defensive security program as a senior member of a small blue team. The role leads incident response and develops detection capabilities across cloud, identity, and workload environments, working with product and platform engineering teams to reduce risk and keep systems secure and compliant.

Responsibilities

- Lead incidents from initial triage through containment, recovery, stakeholder updates, and post-incident review. - Improve response playbooks, severity definitions, on-call practices, and cross-team tabletop exercises. - Build and refine SIEM detections across cloud infrastructure, Kubernetes, and collaboration systems, reducing missed threats and unnecessary alerts. - Investigate activity in cloud, identity, and workload logs; collect and preserve evidence for follow-up. - Assess cloud security posture, including identity permissions, and coordinate prioritized remediation with engineering teams. - Automate security response work and share incident and security posture updates with engineering leaders while mentoring colleagues.

Requirements

- At least five years of blue-team, defensive security, or security operations experience. - Hands-on leadership of incident response, including post-incident actions. - Cloud forensics experience, including log analysis and evidence handling. - Experience creating and tuning SIEM detections mapped to frameworks such as MITRE ATT&CK, CIS, or NIST. - Experience securing AWS and Kubernetes, including reviewing and remediating identity and access permissions. - Python or Bash automation, Terraform infrastructure-as-code experience, cross-team leadership, mentoring, and fluent English.

Benefits and work setup

- Remote work from anywhere in Brazil. - Equity package and paid time off and sick leave without a fixed limit.