Cyber Security Analyst – Red Team (Pleno)

The role

You will plan and run security tests on web apps, APIs, integrations and cloud or CI/CD environments, and test AI applications and agents. You will work with Engineering and Product to find risks early and report findings with clear fixes.

What you will do

• Plan and run security tests on web applications, APIs, microservices and integrations.
• Find and exploit complex vulnerabilities and show their business impact through controlled exploitation.
• Find flaws in business logic, authentication, authorization and access control.
• Perform offensive white-box analysis of source code and write exploits and proofs of concept.
• Assess AI applications, LLMs, RAG, copilots and agents for risks such as prompt injection and data leaks.
• Assess the security of CI/CD pipelines, repositories, dependencies and cloud environments.
• Run threat modeling and support secure design decisions with Engineering and Product teams.
• Build automations that support vulnerability research, validation and prioritization.
• Write clear technical reports with evidence, attack scenarios, impacts and remediation advice.
• Share findings with Engineering teams to improve security practices.

Required qualifications

• Practical experience in offensive security, such as penetration testing of web apps and APIs, Red Team, Bug Bounty or equivalent work.
• Ability to find and exploit complex vulnerabilities and demonstrate impact with proofs of concept.
• Solid knowledge of application exploitation, including business logic, authentication, authorization, access control and chaining flaws.
• Experience with offensive source code analysis.
• Ability to develop exploits, proofs of concept and automations.
• Knowledge of main security risks in AI applications, including prompt injection, sensitive data exposure and misuse of LLMs and agents.
• Familiarity with LLMs, RAG, agents and their integrations.
• Knowledge of web, API, authentication, authorization and service-to-service communication risks.
• Knowledge of security in CI/CD pipelines, software supply chain and cloud environments.
• Familiarity with secure development practices, architecture analysis, threat modeling and SDLC security integration.
• Analytical thinking, technical autonomy, good communication and the ability to document findings and explain risks.

Nice to have

• Relevant offensive security certifications such as OSWE, OSCP, OSEP, BSCP or equivalent.
• Practice on platforms such as Hack The Box, Hacking Club, TryHackMe, PortSwigger Web Security Academy or Root-Me.
• Participation in Capture The Flag competitions or published technical write-ups.
• Relevant Bug Bounty findings, independent security research, reported vulnerabilities or CVEs.
• Practical experience assessing AI agents and their integrations with external systems.
• Experience in fintech, payments, marketplaces or large-scale SaaS platforms.
• Knowledge of containers, Kubernetes and Infrastructure as Code.
• Familiarity with MITRE ATT&CK, MITRE ATLAS, OWASP ASVS and PCI DSS.
• Participation in research, technical publications, talks or offensive security communities.

Benefits

• Health and dental plan with national coverage, at no cost to the employee, with co-payment for spouse and dependents.
• Meal and food voucher (Flash, Visa).
• Flexible benefit (Flash Multibenefícios, Visa) for food, meals, mobility, culture, health and education.
• Private pension plan.
• Transport voucher.
• Life insurance.
• Wellhub membership.
• Childcare allowance for children up to five years old.
• Education budget for investments in your education.
• Online language learning platform.
• Baby On Board support for parents preparing for parenthood.
• Extended maternity leave (180 days) and extended paternity leave (30 days).

About the company

Hotmart is a company whose work aims to transform lives on a global scale. The Red Team area works alongside Engineering and Product to keep the platform's products secure from design onward.