Offensive Security Specialist - RecargaPay

Be the technical reference for RecargaPay's Offensive Security team. You will define how the team protects applications, financial products, and AI assets, ranging from testing strategy and vulnerability management to architecture reviews for critical initiatives. You will work in an AI-first team, leading the adoption of automation and AI agents to scale security across engineering.

Responsibilities

• Define the technical strategy for AppSec and offensive testing: methodology, application and AI asset coverage, business-risk prioritization, and metrics.
• Own the application vulnerability management program, ensuring business-critical issues (financial loss and customer data exposure) are resolved on time, and negotiate with engineering leadership when necessary.
• Conduct threat modeling and architecture reviews for the company's most critical initiatives (such as Pix, credit, cards, and AI agents), influencing design decisions before development.
• Plan and execute complex web application and API pentests, focusing on business logic and attack chains, and transform recurring findings into controls and regression tests.
• Define the scope for external pentests and the annual PCI DSS cycle, serving as the technical reference for external finding triage (bug bounty, consultancies, and external reports).
• Lead the evolution of the team's automations and AI agents to scale code review, triage, and security testing across engineering.
• Represent the team technically in audits, with partner areas, and with leadership, translating technical risk into business decisions.
• Act as the technical reference for the team and substitute for the manager, mentoring senior and mid-level team members.

Requirements

• Experience leading a technical Application Security or offensive testing program in a product company, with end-to-end vulnerability management alongside engineering, business risk prioritization, and leadership-level reporting.
• Mastery of web application and API pentesting (REST/GraphQL), including business logic, authentication, authorization (IDOR/BOLA), and attack chains.
• Security code review in at least one backend language (Java, Kotlin, Go, Python, or Node.js) and architecture-level threat modeling.
• Development of automations and proprietary tools in Python or Go, with practical use of AI (LLMs or agents) in security work such as triage, code review, or testing.
• Degree in technology or a related field, or equivalent experience. Technical English proficiency for reading documentation, advisories, and research.
• Nice to have: Security of LLMs, agents, and MCPs (prompt injection, tool abuse, data exposure).
• Nice to have: Android and iOS mobile pentesting (Frida, objection, Burp Suite).
• Nice to have: Experience in regulated financial environments (PCI DSS, LGPD, BACEN) and audits.
• Nice to have: Certifications such as OSWE, BSCP, OSCP, or equivalents, and public contributions such as CVEs, research, or speaking engagements.

Benefits

• Competitive salary aligned with the market.
• Remote work — wherever you are, you are part of the team!
• Home office allowance via monthly deposit in the RecargaPay app.
• Health and dental insurance without coparticipation.
• Life insurance.
• Flexible meal voucher (via Flash).
• TotalPass for your wellness needs.