Senior Application Security Engineer

Ciklum is looking for a Senior Application Security Engineer to join our team full-time in Brazil.

We are a custom product engineering company that supports both multinational organizations and scaling startups to solve their most complex business challenges. With a global team of over 4,000 highly skilled developers, consultants, analysts and product owners, we engineer technology that redefines industries and shapes the way people live.

About the role:

As a Senior Application Security Engineer, become a part of a cross-functional development team engineering experiences of tomorrow.

You will be responsible for fixing application security issues hands-on, not just reporting them. You will read the code, write the fix, and open the PR. Alongside remediation, you will deploy, configure, and tune our SAST and SCA tooling across our CI/CD pipelines and repositories, triage findings from scanners and penetration tests, and drive them to closure together with the engineering teams that own the code. You will also review pull requests and designs for security issues and help build practical secure coding guidance for developers.

This is a developer-facing role rather than a ticket-filing one, so the ideal candidate is a software engineer who moved into security, or a security engineer who never stopped writing production code. You should be comfortable working in Python and Go, able to explain a finding in plain language to the developer who needs to act on it, and happy to operate the security tooling yourself rather than only consuming its output.

Responsibilities:

Remediate application security findings hands-on: read the code, write the fix, open the PR. This is a dev-facing role, not a ticket-filing role

Deploy, configure, and tune SAST and SCA tooling in our CI/CD pipelines and repos, including rule tuning and false positive cleanup

Triage findings from SAST, SCA, and pen tests, prioritize them, and drive them to closure with engineering teams

Review PRs and designs for security issues and help build secure coding guidance for developers

Requirements:

Software development background in Python and Go. Must be comfortable writing production code and opening PRs

Hands-on AppSec experience, especially vulnerability remediation (OWASP Top 10, dependency vulns, secrets, auth/session issues)

Direct experience deploying and operating SAST and SCA tools in CI/CD, not just consuming their output

Works well with developers and can explain findings in plain language

Available during US business hours

Desirable:

Healthcare or other regulated-industry experience

What’s in it for you?

Care: your mental and physical health is our priority. We ensure comprehensive company-paid medical insurance and mental health programs, 5 undocumented sick-leave days per year

Tailored education path: boost your skills and knowledge with our regular internal events (meetups, conferences, workshops), Udemy license, language courses and company-paid certifications

Growth environment: share your experience and level up your expertise with a community of skilled professionals, locally and globally

Long-term employment with 20 working-days paid vacation and local bank holidays

Flexibility: 100% remote work mode

Opportunities: we value our specialists and always find the best options for them. Our Internal Mobility Program helps change a project if needed to help you grow, excel professionally and fulfill your potential

Global impact: work on large-scale projects that redefine industries with international and fast-growing clients

Welcoming environment: feel empowered with a friendly team, open-door policy, informal atmosphere within the company and regular team-building events

About us:

At Ciklum, we are always exploring innovations, empowering each other to achieve more, and engineering solutions that matter. With us, you’ll work with cutting-edge technologies, contribute to impactful projects, and be part of a One Team cultur