Grupo QuintoAndar | Senior Offensive Security Engineer

• Offensive Security Track Record: Proven background operating as a Senior/Staff Offensive Security Engineer, Senior “Red Teamer”, or Principal Penetration Tester conducting complex assessments against web apps, APIs, distributed cloud environments, and internal networks.
• AI & Agentic Architectures: Hands-on experience developing or architecting LLM-driven applications, agentic workflows, tool calling, autonomous agent sandboxing, and adversarial AI evaluation.
• Cloud-Native & Container Mastery: Deep practical knowledge of container runtimes, Kubernetes architecture (RBAC, admission controllers, pod security standards, network policies, service mesh), and major cloud platforms. Demonstrated capability exploiting and hardening containerized infrastructure.
• Software Engineering Fundamentals: Solid programming proficiency to build production-grade tooling, microservices, pipeline integrations, and custom agent skills.
• Vulnerability Management & Detection Integration: Proven experience integrating offensive discoveries into enterprise vulnerability management engines (Jira, DefectDojo, or custom risk aggregators) and telemetry tools (SIEM).

• Experience operating red/purple team operations in high-velocity tech, fintech, or hyper-growth marketplaces.
• Prior open-source contributions or research in automated exploitation, agentic systems, or cloud security tooling.
• Industry certifications demonstrating deep offensive or cloud knowledge (e.g., OSCP, OSEP, OSWE, CKS, AWS Certified Security - Specialty) or equivalent demonstrated domain expertise.

Important

Our hiring process starts with the application! If you truly want to be part of our team, please complete this step of the process. We analyze all candidates individually and provide feedback to all applicants. All communication will be conducted via email, so please stay tuned for our messages and release the domain @quintoandar.com.br to ensure our emails are not sent to spam.

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

Language

This job description is written in English because for that position you will need it for communications with coworkers and suppliers who are from worldwide, for tools and internal materials as well.

Our selection process currently lasts an average of 40 days, from application to completion of the assessment. Going through:

• - Application
• Interview with Recruiters
• Tech Screening with Engineering Team (Coding Interview)
• Technicals Interviews (Architecture live cases)
• Offer

• Architect Autonomous Offensive Systems: Design, build, and pilot the end-to-end architecture of an AI-agent-powered offensive security platform. Select model paradigms, agentic frameworks, and tool-use orchestration pipelines to autonomously identify attack paths, test APIs/applications, and probe cloud-native environments.
• Global Attack Surface Operations: Plan, conduct continuous, systematic testing against QuintoAndar’s global attack surface, complex microservices architectures, containerized workloads, and kubernetes clusters.
• Unified Ecosystem Integration: Close the loop between offense and defense. Connect automated agent findings with Vulnerability Management pipelines, SIEM/SOAR platforms, CTI feeds, and Blue Team detection engineering workflows to drive real-time remediation, automated retests, and proactive defense tuning.
• Architecture & RFCs: Write comprehensive RFCs and technical design documents defining AI agent protocols, offensive automation standards, containment boundaries, and secure sandboxing mechanisms to ensure autonomous testing runs safely and reliably in production and non-production environments.

• End-to-End Delivery: Drive complex, multi-team engineering deliverables from scoping to operational deployment, balancing bold innovation with platform resilience and uptime.
• Risk Mapping & Executive Communication: Translate complex attack graphs, exploitation proofs-of-concept (PoCs), and vulnerability telemetry into clear business risk impact for Product Managers, Engineering Directors, and executive forums.
• Strategic Triaging & Retesting: Automate the noise out of vulnerability triage. Deploy AI agent capabilities to dynamically validate exploitability, evaluate environmental compensating controls, prioritize remediation based on actual business exposure, and execute automated retests upon patch release.
• Incident Ownership & Operational Stability: Serve as a subject matter expert during severe security incidents, contributing deep adversary perspectives, leading red/purple team debriefs, and eventually owning corrective post-mortem engineering initiatives.

• Raise the Technical Bar: Lead offensive architecture reviews and threat modeling sessions across core platforms, enforcing high benchmarks for resilience, monitoring, and defensive posture.
• Talent Multiplier: Mentor and elevate senior and mid-level security engineers across the team. Delegate critical architectural tracks to foster growth, design interview standards for offensive and AI hiring, and build an environment grounded in psychological safety and high performance.

• Cross-Department Influence: Demonstrated success leading initiatives that cut across engineering, product, and infrastructure boundaries, negotiating technical roadmaps, and resolving cross-system dependencies.
• Business-Centric Mindset: Ability to evaluate technical risk through a business value and revenue-impact lens, prioritizing vulnerabilities that threaten platform trust, customer data, and transactional operations.
• Communication & Presence: Exceptional verbal and written communication skills; experienced in presenting technical strategies to senior leadership and translating complex security topics for non-technical stakeholders.
• Commitment to Engineering Rigor: Strong track record of contributing to and reviewing RFCs, institutionalizing best practices, and mentoring junior and mid-level peers.

• Competitive salary
• Profit sharing
• Meal allowance
• Health insurance
• Dental plan
• Life insurance
• Childcare subsidy and Atypical Parenthood subsidy
• Wellhub
• Home office allowance
• Employee assistance program (mental health, social, legal, and financial support)
• Extended parental leave
• Day off on birthday, Mother’s Day, and Father’s Day
• Benefits Club (discounts on everyday services)
• Discounts at educational institutions
• Reading kit for children – PlayKids

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/.

About Working at QuintoAndar

• Possibility of learning;
• Opportunity to work in a team that seeks to use the best practices and tools in the market;
• Work in an informal environment with a horizontal structure;
• Being part of a team working on a high-impact project that affects the lives of thousands of people.