高级安全工程师（应用安全）
Senior Security Engineer (Application Security)
关于Nu
Nu是拉丁美洲领先的数字银行，服务于巴西、墨西哥和哥伦比亚的1.4亿客户。公司通过利用数据和专有技术，开发创新产品和服务，引领行业变革。
以对抗复杂性和赋能人们为使命，Nu为客户提供完整的金融旅程，通过负责任的贷款和透明度促进金融准入和进步。公司由高效且可扩展的商业模式驱动，结合低成本服务与不断增长的回报。
Nu的影响已获得多项奖项的认可，包括《时代》100家最具影响力公司、《快公司》最具创新力公司以及福布斯全球最佳银行。
访问我们的机构页面 https://www.nu.com/2026-en
关于团队
应用安全团队是信息安全部门的一部分。该团队专注于主动发现和缓解Nubank上的潜在安全威胁，以保护客户的金融资产和数据。为此，我们执行许多任务，例如在应用程序中嵌入和开发安全控制，在软件开发生命周期中支持所有工程师。
我们的AppSec团队处于Nubank安全创新的最前沿。我们认为安全应该是推动者，而不是阻碍者，并构建可扩展的解决方案，帮助开发者无摩擦地发布安全代码。从设计人工智能驱动的威胁建模工具到在CI/CD中自动化安全，我们的工作影响每一位Nubanker工程师。
关于职位
作为我们应用安全（AppSec）团队的安全工程师，您将加入负责在整个Nubank工程组织中推动安全软件开发实践的小组。我们通过在他们的SDLC中嵌入安全，支持使用多样化技术栈（包括Clojure、Python、Go用于后端，Kotlin、Swift、Dart用于移动端）的团队。
这个职位适合对应用安全概念有扎实基础的人，喜欢与工程团队紧密合作推动安全最佳实践，并对AI安全和威胁建模等新兴领域有浓厚兴趣的人。
您的职责将包括帮助设计和部署安全工具到我们的CI/CD流水线（SAST、DAST、SCA），为新项目进行威胁建模，支持安全审查，并参与AppSec流程的自动化，包括那些涉及安全测试的流程。
查看英文原文
ABOUT NU
Nu is the leading digital bank in Latin America, serving 140 million customers across Brazil, Mexico, and Colombia. The company has been leading an industry transformation by leveraging data and proprietary technology to develop innovative products and services.
Guided by its mission to fight complexity and empower people, Nu caters to customers’ complete financial journey, promoting financial access and advancement with responsible lending and transparency. The company is powered by an efficient and scalable business model that combines low cost to serve with growing returns.
Nu’s impact has been recognized in multiple awards, including Time 100 Most Influential Companies, Fast Company’s Most Innovative Companies, and Forbes World’s Best Banks.
Visit our Institutional Page https://www.nu.com/2026-en
About the team
The Application Security team is part of the Information Security area. The team focuses on proactive hunting for and mitigating potential security threats on Nubank to protect our customers' financial assets and data. For that, we perform many tasks such as embedding and developing security controls on the applications, supporting all engineers during the software development lifecycle.
Our AppSec team is at the forefront of enabling secure innovation at Nubank. We believe security should be an enabler, not a blocker, and we build scalable solutions to help developers ship secure code without friction. From designing AI-powered threat modeling tools to automating security in CI/CD, our work impacts every Nubanker engineer.
About the role
As a Security Engineer in our Application Security (AppSec) team, you will be part of the group responsible for enabling secure software development practices across Nubank’s entire engineering organization. We support teams working with a diverse technology stack – including Clojure, Python, Go for backend and Kotlin, Swift, Dart for mobile – by embedding security into their SDLC.
This role is ideal for someone with a strong foundation in application security concepts, who enjoys working closely with engineering teams to drive security best practices, and who has a keen interest in emerging areas such as AI security and threat modeling.
Your mission will include helping design and deploy security tools in our CI/CD pipelines (SAST, DAST, SCA), performing threat modeling for new projects, supporting security reviews, and contributing to the automation of AppSec processes, including those involving new AI technologies like Model Context Protocol (MCP) Servers and agents.
You'll be responsible for
Embed security practices into the SDLC across backend, mobile, and web applications.
- Deploy and maintain security tools (SAST, DAST, SCA, MAST) in CI/CD pipelines.
- Perform threat modeling and security reviews for new and existing projects.
- Develop scripts and tools (Python, Go, Bash) to automate security checks and processes.
- Collaborate with engineering teams to explain and remediate vulnerabilities.
- Support AI-related security initiatives, ensuring safe adoption of ML/AI features in products.
- Contribute to the evolution of internal security guidelines and baselines.
- Participate in cross-functional discussions to align security requirements with business goals.
WE ARE LOOKING FOR A PERSON WHO HAS
MUST-HAVE
- Solid understanding of application security concepts and secure software development practices.
- Hands-on experience with CI/CD pipelines and implementing security tools (e.g., SAST, DAST, SCA).
- Knowledge of scripting/programming with commonly used languages like Python, Go, bash, etc for automation and tooling.
- Familiarity with container security tools (e.g., Trivy, Aqua).
- Experience working with modern software architectures: Web, Mobile, APIs, and MCPs.
- Strong communication and collaboration skills to work with multi-disciplinary teams.
Nice to Have
- Previous experience conducting security assessments in distributed systems environments.
- Experience with tools like Semgrep, Fortify, Checkmarx, Veracode.
- Experience with pipeline tools like Github Actions, Gitlab Workflow, others.
- Experience with AI security concepts and emerging AI/ML security risks.
- Familiarity with threat modeling methodologies (e.g., STRIDE, PASTA, OWASP Threat Dragon).
- Knowledge of regulatory and compliance requirements relevant to financial services.
LOCATION
São Paulo, Brazil
Campinas, Brazil
Rio de Janeiro, Brazil
Belo Horizonte, Brazil
OUR BENEFITS
- Chance of earning equity at Nubank
- Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
- Public Transportation Commuting Benefit (Vale-Transporte)
- NuCare – Psychological, Financial and Legal Assistance Program
- Life Insurance
- Medical Plan
- Dental Plan
- NuLanguage – Language Course Program
- Nucleo - Our learning platform of courses
- Extended Parental Leave
- Daycare Allowance
- Parental Consultancy
- Work-from-home Allowance
- Gym Partnerships
- 30 days of paid vacation
- Relocation Assistance Package, if applicable
WORK MODEL FOR THIS ROLE
Hybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration. For more details, visit https://building.nubank.com/nu-hybrid-work-model/
Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.