Staff Security Engineer | Application Security

p strong Your wellbeing, our mission. Join a company shaping a healthier world. /strong /p p strong GET TO KNOW US /strong /p p At Wellhub we're revolutionizing workplace wellness. Our platform connects employees worldwide to the best partners for fitness, mindfulness, therapy, nutrition, and sleep—all in one simple subscription. Headquartered in NYC with team members in Europe, North America and South America, we’re on a mission to make every company a wellness company. /p p We believe work should be fulfilling, inspiring, and balanced. Here, you’ll find a team that values wellbeing, collaboration, and different perspectives, where passion and creativity push boundaries to create real impact. Your contributions will help shape a healthier, more balanced world for you and millions of people globally. nbsp; /p p strong Join us in redefining the future of wellbeing! /strong /p p nbsp; /p p strong THE OPPORTUNITY /strong /p p /p p We are hiring a strong Staff Security Engineer | AppSec /strong to our strong Information Security team /strong in strong Brazil! /strong This is a strong Remote – Brazil /strong position, meaning you can work from anywhere within the country. Please note that this role is only open to candidates in Brazil. nbsp; /p p The Information Security team is responsible for protecting our subscription-based product serving millions of users. As a Staff Security Engineer, you will own multiple security domains end-to-end — your center of gravity will likely be software security (secure SDLC, vulnerability management, threat modeling, pentesting, and red teaming), while the role also reaches into incident response, threat intelligence, cloud security, and compliance/GRC as the team's mandate requires. You will become the team's go-to authority for the hardest security trade-offs — the ones that cut across domains and don't have an obvious owner. With deep hands-on expertise in one or more of these sub-domains and working familiarity across the rest, you will connect pentest findings, incident root causes, compliance requirements, and cloud misconfigurations into a unified risk strategy — bringing threat intelligence and compliance into day-to-day engineering decisions and raising the security bar across the organization. /p p nbsp; /p p strong YOUR IMPACT /strong /p p strong /strong /p p strong data-path-to-node= 10,0,0 data-index-in-node= 0 /strong /p ul li data-path-to-node= 5,0,0 Own multiple security domains end-to-end (e.g., application security, threat intelligence, detection engineering, cloud security posture), navigating cross-team dependencies and understanding the tech stacks you're protecting. /li li data-path-to-node= 5,0,0 Lead system and architectural reviews and threat modeling for high-risk projects, enforcing secure-by-design standards, setting secure-coding benchmarks, and reinforcing the use of company-standard security platforms and controls. /li li data-path-to-node= 5,0,0 Scope, hire, or directly run pentests and red team exercises against critical systems, driving root-cause fixes directly with engineering rather than letting findings pile up as backlog. /li li data-path-to-node= 5,0,0 Own and drive the resolution of complex, cross-service vulnerabilities and security incidents, coordinating multiple engineering teams, communicating status to stakeholders, and turning postmortems into concrete guardrails that prevent recurrence and improve detection/response maturity. /li li data-path-to-node= 5,0,0 Set and enforce clear security KPIs, SLAs, and SLOs across the domains you touch (e.g., detection and response times, patch/remediation windows, cloud posture drift), building the monitoring and alerting needed to hold the organization accountable. /li li data-path-to-node= 5,0,0 Drive architecture decisions across interconnected systems to reduce security debt, anticipating where technical debt introduces risk and proactively addressing it. /li li data-path-to-node= 5,0,0 P