Staff Security Engineer | Application Security

Responsibilities

The Staff Security Engineer will own multiple security domains end-to-end, focusing on software security, threat modeling, and incident response. They will lead architectural reviews, enforce secure-by-design standards, and drive the resolution of complex security vulnerabilities across the organization.

Requirements

The role requires extensive experience in security engineering with deep hands-on expertise in at least one sub-domain like AppSec or Cloud Security. Candidates must be pragmatic problem-solvers with strong communication skills in English and the ability to lead cross-functional security initiatives.

Skills

• Application security
• Secure SDLC
• Vulnerability management
• Threat modeling
• Pentesting
• Red teaming
• Incident response
• Threat intelligence
• Cloud security
• GRC
• Detection engineering
• Identity and access management
• Security architecture
• Automation
• Risk management
• Compliance

Benefits

• Gold+ membership
• Emotional wellbeing program
• Individual therapy sessions
• Health insurance
• Dental insurance
• Life insurance
• Home office reimbursement
• Paid time off
• Paid parental leave
• Career growth resources

About this role

Your wellbeing, our mission. Join a company shaping a healthier world.
GET TO KNOW US
At Wellhub we're revolutionizing workplace wellness. Our platform connects employees worldwide to the best partners for fitness, mindfulness, therapy, nutrition, and sleep—all in one simple subscription. Headquartered in NYC with team members in Europe, North America and South America, we’re on a mission to make every company a wellness company.
We believe work should be fulfilling, inspiring, and balanced. Here, you’ll find a team that values wellbeing, collaboration, and different perspectives, where passion and creativity push boundaries to create real impact. Your contributions will help shape a healthier, more balanced world for you and millions of people globally.
Join us in redefining the future of wellbeing!
THE OPPORTUNITY
We are hiring a Staff Security Engineer | AppSec to our Information Security team in Brazil! This is a Remote – Brazil position, meaning you can work from anywhere within the country. Please note that this role is only open to candidates in Brazil.
The Information Security team is responsible for protecting our subscription-based product serving millions of users. As a Staff Security Engineer, you will own multiple security domains end-to-end — your center of gravity will likely be software security (secure SDLC, vulnerability management, threat modeling, pentesting, and red teaming), while the role also reaches into incident response, threat intelligence, cloud security, and compliance/GRC as the team's mandate requires. You will become the team's go-to authority for the hardest security trade-offs — the ones that cut across domains and don't have an obvious owner. With deep hands-on expertise in one or more of these sub-domains and working familiarity across the rest, you will connect pentest findings, incident root causes, compliance requirements, and cloud misconfigurations into a unified risk strategy — bringing threat intelligence and compliance into day-to-day engineering decisions and raising the security bar across the organization.
YOUR IMPACT
Own multiple security domains end-to-end (e.g., application security, threat intelligence, detection engineering, cloud security posture), navigating cross-team dependencies and understanding the tech stacks you're protecting.
Lead system and architectural reviews and threat modeling for high-risk projects, enforcing secure-by-design standards, setting secure-coding benchmarks, and reinforcing the use of company-standard security platforms and controls.
Scope, hire, or directly run pentests and red team exercises against critical systems, driving root-cause fixes directly with engineering rather than letting findings pile up as backlog.
Own and drive the resolution of complex, cross-service vulnerabilities and security incidents, coordinating multiple engineering teams, communicating status to stakeholders, and turning postmortems into concrete guardrails that prevent recurrence and improve detection/response maturity.
Set and enforce clear security KPIs, SLAs, and SLOs across the domains you touch (e.g., detection and response times, patch/remediation windows, cloud posture drift), building the monitoring and alerting needed to hold the organization accountable.
Drive architecture decisions across interconnected systems to reduce security debt, anticipating where technical debt introduces risk and proactively addressing it.
Plan and execute security-relevant migrations and platform updates (identity, cloud, key management, etc.) seamlessly, preserving data integrity and security guarantees throughout.
Manage end-to-end delivery of medium-to-large security initiatives (e.g., a red team program buildout, removal of classes of vulnerabilities, a compliance audit, a zero-trust rollout, a cloud security hardening effort, or a detection coverage program), balancing quick wins with long-term risk reduction.Live the mission: inspire and empower others by genuinely caring for your own wellbeing and your colleagues. Bring wellbeing to the forefront of work, and create a supportive environment where everyone feels comfortable taking care of themselves, taking time off, and finding work-life balance.
WHO YOU ARE
A versatile security specialist with deep hands-on experience in one or more security sub-domains (AppSec, Security Architecture, Cloud/Infra Security, IAM, or Detection & Response) and working familiarity across the others.
A hands-on builder who writes secure, well-tested code for security tooling and automation (e.g., detection rules, scanners, IAM guardrails), and sets the secure-coding standards others follow.
A pragmatic problem-solver and mentor who can navigate legacy systems and messy environments, spotting refactoring and hardening opportunities and guiding engineers on how to find and fix what generic reviews miss.
A strategic technical leader who has led RFCs and design docs for security-sensitive changes, knowing how to document threat models, risk trade-offs, and failure predictions clearly for both technical and non-technical audiences.
A composed collaborator comfortable facilitating hard conversations — pushing back on product scope for security reasons, negotiating remediation timelines with stakeholders, or explaining a risk-acceptance decision to leadership.
A forward-looking risk navigator who thinks in mid-to-long-term horizons, weighing security trade-offs against feasibility and business priorities to proactively surface risks before they become incidents.
A proactive industry learner who stays current on the threat landscape and industry practices relevant to Wellhub (e.g., attacker TTPs, compliance frameworks like SOC 2, ISO 27001, LGPD, and GDPR) and brings that knowledge back to shape team strategy.
An influential communicator with fluency in English and strong communication skills to translate complex technical security concepts into actionable guidance for engineering teams at all levels.
A seasone...

About Wellhub

Wellness and Fitness Services · 1,001-5,000 employees · headquartered in New York, NY · founded 2012