Grupo QuintoAndar | Senior Offensive Security Engineer

Title: Grupo QuintoAndar | Senior Offensive Security Engineer Location: Brasil

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit:  .

About Working at QuintoAndar

• Possibility of learning;
• Opportunity to work in a team that seeks to use the best practices and tools in the market;
• Work in an informal environment with a horizontal structure;
• Being part of a team working on a high-impact project that affects the lives of thousands of people.

Location & Remote Work 

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

Language

This job description is written in English because for that position you will need it for communications with coworkers and suppliers who are from worldwide, for tools and internal materials as well.

Hiring Process Stages

Our selection process currently lasts an average of 40 days, from application to completion of the assessment. Going through:

• • Application
  • Interview with Recruiters
  • Tech Screening with Engineering Team (Coding Interview)
  • Technicals Interviews (Architecture live cases)
  • Offer

About the Role

QuintoAndar is transforming the real estate ecosystem globally through cutting-edge technology, product velocity, and operational scale. As our digital footprint expands across distributed platforms, microservices, and regional markets, traditional penetration testing and point-in-time assessments can no longer match our pace of deployment.

We are seeking a Senior Offensive Security Engineer (SE4 - Banda 8) to spearhead a paradigm shift: pioneering, architecting, and piloting our AI-Driven Offensive Security Program. In this role, you will design and orchestrate a distributed "squad" of autonomous AI agents capable of continuous reconnaissance, dynamic attack surface mapping, deep penetration testing, smart triage, and automated verification across QuintoAndar's global infrastructure, containerized workloads, Kubernetes clusters, and customer-facing products.

Operating as a Senior Engineer, you will combine world-class offensive engineering depth with strategic systems design, stakeholder influence, and mentorship. You will bridge offensive capabilities directly with our Defensive Security, Cyber Threat Intelligence (CTI), Vulnerability Management, and Engineering teams, ensuring risks are mapped, contextualized, and systematically eliminated.

Key Responsibilities

Strategy, Architecture & Technical Ownership

• Architect Autonomous Offensive Systems: Design, build, and pilot the end-to-end architecture of an AI-agent-powered offensive security platform. Select model paradigms, agentic frameworks, and tool-use orchestration pipelines to autonomously identify attack paths, test APIs/applications, and probe cloud-native environments.
• Global Attack Surface Operations: Plan, conduct continuous, systematic testing against QuintoAndar’s global attack surface, complex microservices architectures, containerized workloads, and kubernetes clusters.
• Unified Ecosystem Integration: Close the loop between offense and defense. Connect automated agent findings with Vulnerability Management pipelines, SIEM/SOAR platforms, CTI feeds, and Blue Team detection engineering workflows to drive real-time remediation, automated retests, and proactive defense tuning.
• Architecture & RFCs: Write comprehensive RFCs and technical design documents defining AI agent protocols, offensive automation standards, containment boundaries, and secure sandboxing mechanisms to ensure autonomous testing runs safely and reliably in production and non-production environments.

Technical Leadership, Delivery & Cross-Team Impact

• End-to-End Delivery: Drive complex, multi-team engineering deliverables from scoping to operational deployment, balancing bold innovation with platform resilience and uptime.
• Risk Mapping & Executive Communication: Translate complex attack graphs, exploitation proofs-of-concept (PoCs), and vulnerability telemetry into clear business risk impact for Product Managers, Engineering Directors, and executive forums.
• Strategic Triaging & Retesting: Automate the noise out of vulnerability triage. Deploy AI agent capabilities to dynamically validate exploitability, evaluate environmental compensating controls, prioritize remediation based on actual business exposure, and execute automated retests upon patch release.
• Incident Ownership & Operational Stability: Serve as a subject matter expert during severe security incidents, contributing deep adversary perspectives, leading red/purple team debriefs, and eventually owning corrective post-mortem engineering initiatives.

Culture, Mentorship & Engineering Standards

• Raise the Technical Bar: Lead offensive architecture reviews and threat modeling sessions across core platforms, enforcing high benchmarks for resilience, monitoring, and defensive posture.
• Talent Multiplier: Mentor and elevate senior and mid-level security engineers across the team. Delegate critical architectural tracks to foster growth, design interview standards for offensive and AI hiring, and build an environment grounded in psychological safety and high performance.

What We Are Looking For

Technical Qualifications

• Offensive Security Track Record: Proven background operating as a Senior/Staff Offensive Security Engineer, Senior “Red Teamer”, or Principal Penetration Tester conducting complex assessments against web apps, APIs, distributed cloud environments, and internal networks.
• AI & Agentic Architectures: Hands-on experience developing or architecting LLM-driven applications, agentic workflows, tool calling, autonomous agent sandboxing, and adversarial AI evaluation.
• Cloud-Native & Container Mastery: Deep practical knowledge of container runtimes, Kubernetes architecture (RBAC, admission controllers, pod security standards, network policies, service mesh), and major cloud platforms. Demonstrated capability exploiting and hardening containerized infrastructure.
• Software Engineering Fundamentals: Solid programming proficiency to build production-grade tooling, microservices, pipeline integrations, and custom agent skills.
• Vulnerability Management & Detection Integration: Proven experience integrating offensive discoveries into enterprise vulnerability management engines (Jira, DefectDojo, or custom risk aggregators) and telemetry tools (SIEM).

Professional & Leadership Attributes (Banda 8 Alignment)

• Cross-Department Influence: Demonstrated success leading initiatives that cut across engineering, product, and infrastructure boundaries, negotiating technical roadmaps, and resolving cross-system dependencies.
• Business-Centric Mindset: Ability to evaluate technical risk through a business value and revenue-impact lens, prioritizing vulnerabilities that threaten platform trust, customer data, and transactional operations.
• Communication & Presence: Exceptional verbal and written communication skills; experienced in presenting technical strategies to senior leadership and translating complex security topics for non-technical stakeholders.
• Commitment to Engineering Rigor: Strong track record of contributing to and reviewing RFCs, institutionalizing best practices, and mentoring junior and mid-level peers.

Preferred Qualifications & Certifications

• Experience operating red/purple team operations in high-velocity tech, fintech, or hyper-growth marketplaces.
• Prior open-source contributions or research in automated exploitation, agentic systems, or cloud security tooling.
• Industry certifications demonstrating deep offensive or cloud knowledge (e.g., OSCP, OSEP, OSWE, CKS, AWS Certified Security - Specialty) or equivalent demonstrated domain expertise.

Important

Benefits

• Competitive salary
• Profit sharing
• Meal allowance
• Health insurance
• Dental plan
• Life insurance
• Childcare subsidy and Atypical Parenthood subsidy
• Wellhub
• Home office allowance
• Employee assistance program (mental health, social, legal, and financial support)
• Extended parental leave
• Day off on birthday, Mother’s Day, and Father’s Day
• Benefits Club (discounts on everyday services)
• Discounts at educational institutions
• Reading kit for children – PlayKids

Diversity & Inclusion at Grupo QuintoAndar

We value diversity and want everyone to feel welcome here, regardless of their age, gender identity, sexual orientation, race, color, ethnicity, origin, disability, religion, or any other characteristic. All our job openings are open to all individuals!

You'll notice there are some diversity questions in the application form. For affirmative action roles, this information may be used to verify your alignment with the target audience for the opportunity. In such cases, it may be used for elimination purposes. For non-affirmative action roles, this data will be used anonymously, exclusively to monitor and improve our inclusion practices in the hiring process, and will have no impact on your application.

Privacy and Data Protection

The Grupo QuintoAndar operates in compliance with privacy and data protection laws, including, but not limited to, the Brazilian General Personal Data Protection Law (LGPD) (Law No. 13,709/2018), and ensures the security of your data. To learn more, please access our Privacy Notice for Candidates. For questions or to exercise your rights as a data subject, please contact us through our Service Channel.
#LI-CO2