Senior Security / QA Lead - 12 Weeks (569)

Info on the Senior Security / QA Lead role Want to get to the next step in your international career? We can support you! Ubiminds is a GPTW-certified, people-first company that partners with American software product companies to scale their development footprint. Ubi custom-curates Brazilian top 5% talent for their LATAM strategy, offering a unique combo of staff augmentation and employer-of-record services.   Challenge We’re looking for a Senior Security / QA Lead to own the adversarial security testing strategy. You will validate the platform against its existing freeze-audit self-test suite and design and lead the security coverage layered on top of it. This is a lead role within the workstream and requires someone who can combine strong security-testing expertise with hands-on technical skills, rigorous defect reporting, and the ability to work directly against a real codebase. The engagement is full-time, approximately 12 weeks, and remote within LATAM. Responsibilities Design and lead adversarial security testing of the deterministic decision path. Attempt to defeat default-DENY, escalate privileges, or cross tenant boundaries, and prove that the boundaries hold. Test multi-tenant isolation and owner-versus-customer scoping through the platform’s roster subsystem, using real tenant-scoped identities. Verify the tamper-resistance of the hash-chained audit trail, including append-only behavior, hash-chain linkage, and detection of attempted mutation. Validate authentication and authorization across tenant and operator roles. Review and extend the existing per-module freeze-audit self-tests. Ensure every governance rule resolves through the live intake path to a real engine record. Rank findings by severity and provide clear reproduction steps in GitHub Issues. Keep findings in the same line of sight as the freeze-audit CI gate. Uphold the merge gate: nothing lands unless freeze-audit CI is green. Partner with the client on architectural sign-off for any governance-core change.   Mandatory Skills Strong security-testing background, including penetration testing, authorization/access-control testing, or security QA against systems where boundary failure is the primary risk. Hands-on experience with Python and comfort reading a real codebase to design tests against it. Experience with multi-tenant SaaS and a practical understanding of tenant isolation failure modes. Practical understanding of cryptographic audit trails / hash chaining and how tamper-evidence is proven. Experience with Docker and CI-based workflows, including GitHub Actions or equivalent. Ability to work against a green-CI merge gate. Proficiency with Postgres for validating durable state and persistence. Clear written English. Strong ability to produce rigorous, reproducible defect reports. Nice to Have Experience testing policy engines, authorization systems, or agentic-AI guardrails. Exposure to SOC 2 controls and evidence expectations. Familiarity with Render or comparable container hosting. Background working in a regulated or safety-critical domain. Team & Environment Workstream: Nehemiah Layer. Focus: Security testing, adversarial coverage, and audit-chain integrity. Seniority: Senior / Lead. Reports to: Ubiminds Engagement Manager. Full-time engagement of approximately 12 weeks. Remote position within LATAM. High-impact environment focused on security, governance, and platform integrity. Strong emphasis on reproducible testing, CI enforcement, and architectural sign-off. Success in the First 12 Weeks A documented adversarial test suite that meaningfully attacks default-DENY and tenant isolation, with results. Independent verification of audit-chain tamper-evidence. A severity-ranked findings report that the client can take toward SOC 2 posture and a production pilot. Freeze-audit CI green and a defect flow running cleanly through it. About Ubiminds Our Culture People First. We are all about people! Challenge Yourself. Continuous improvement is