tessera-labs - Senior Product Security Engineer

• A strong track record in product or application security — you've measurably made real products more secure. • Hands-on penetration testing experience against web applications and APIs. • Deep understanding of how modern web applications work — single-page front ends, APIs, authentication and authorization (for example, OAuth 2.0 / OpenID Connect), sessions, and the common ways each is attacked (for example, the Open Worldwide Application Security Project, or OWASP, Top 10). • Experience running security design reviews and threat modeling. • Solid understanding of the SDLC and how to embed security into it. • Strong communication skills — you work directly with developers and can explain risk in terms they'll act on. • Familiarity with open-source security tooling (for example, OWASP ZAP and Burp Suite Community Edition for testing, Semgrep for SAST, Trivy or Grype for dependency and container scanning, Nuclei for templated scanning). • A relevant offensive-security certification (for example, Offensive Security Certified Professional, or OSCP). • Cloud security experience (Amazon Web Services, Microsoft Azure, or Google Cloud Platform) and container / Kubernetes security. • Experience supporting a SOC 2, International Organization for Standardization (ISO) 27001, or similar program. • Background in enterprise or regulated environments where deployment security is non-negotiable. • What Success Looks Like (First 90 Days) • You've reviewed the product's architecture and threat surface and identified the highest-priority security risks. • A repeatable, lightweight process exists for security design reviews on new work. • Security findings have a clear triage-to-remediation path, and developers know how to engage you early. • Location and Work Model • Remote in Brazil or LATAM