Grupo QuintoAndar | Senior Offensive Security Engineer

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/ .

About Working at QuintoAndar

Possibility of learning;

Opportunity to work in a team that seeks to use the best practices and tools in the market;

Work in an informal environment with a horizontal structure;

Being part of a team working on a high-impact project that affects the lives of thousands of people.

Location & Remote Work

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

Language

This job description is written in English because for that position you will need it for communications with coworkers and suppliers who are from worldwide, for tools and internal materials as well.

Hiring Process Stages

Our selection process currently lasts an average of 40 days, from application to completion of the assessment. Going through:

Application

Interview with Recruiters

Tech Screening with Engineering Team (Coding Interview)

Technicals Interviews (Architecture live cases)

Offer

About the Role

QuintoAndar is transforming the real estate ecosystem globally through cutting-edge technology, product velocity, and operational scale. As our digital footprint expands across distributed platforms, microservices, and regional markets, traditional penetration testing and point-in-time assessments can no longer match our pace of deployment.

We are seeking a Senior Offensive Security Engineer (SE4 - Banda 8) to spearhead a paradigm shift: pioneering, architecting, and piloting our AI-Driven Offensive Security Program . In this role, you will design and orchestrate a distributed "squad" of autonomous AI agents capable of continuous reconnaissance, dynamic attack surface mapping, deep penetration testing, smart triage, and automated verification across QuintoAndar's global infrastructure, containerized workloads, Kubernetes clusters, and customer-facing products.

Operating as a Senior Engineer , you will combine world-class offensive engineering depth with strategic systems design, stakeholder influence, and mentorship. You will bridge offensive capabilities directly with our Defensive Security, Cyber Threat Intelligence (CTI), Vulnerability Management, and Engineering teams, ensuring risks are mapped, contextualized, and systematically eliminated.

Key Responsibilities

Strategy, Architecture & Technical Ownership

Architect Autonomous Offensive Systems: Design, build, and pilot the end-to-end architecture of an AI-agent-powered offensive security platform. Select model paradigms, agentic frameworks, and tool-use orchestration pipelines to autonomously identify attack paths, test APIs/applications, and probe cloud-native environments.

Global Attack Surface Operations: Plan, conduct continuous, systematic testing against QuintoAndar’s global attack surface, complex microservices architectures, containerized workloads, and kubernetes clusters.

Unified Ecosystem Integration: Close the loop between offense and defense. Connect automated agent findings with Vulnerability Management pipelines, SIEM/SOAR platforms, CTI feeds, and Blue Team detection engineering workflows to drive real-time remediation, automated retests, and proactive defense tuning.

Architecture & RFCs: Write comprehensive RFCs and technical design documents defining AI agent protocols, offensive automation standards, containment boundaries, and secure sandboxing mechanisms to ensure autonomous testing runs safely and reliably in production and non-production environments.

Technical Leadership, Delivery & Cross-Team Impact

End-to-End Delivery: Drive complex, multi-team engineering deliverables from scoping to operational deployment, balancing bold innovation with platform resilience and uptime.

Risk Mapping & Executive Communication: Translate complex attack graphs, exploitation proofs-of-concept (PoCs), and vulnerability telemetry into clear business risk impact for Product Managers, Engineering Directors, and executive forums.

Strategic Triaging & Retesting: Automate the noise out of vulnerability triage. Deploy AI agent capabilities to dynamically validate exploitability, evaluate environmental compensating controls, prioritize remediation based on actual business exposure, and execute automated retests upon patch release.

Incident Ownership & Operational Stability: Serve as a subject matter expert during severe security incidents, contributing deep adversary perspectives, leading red/purple team debriefs, and eventually owning corrective post-mortem engineering initiatives.

Culture, Mentorship & Engineering Standards

Raise the Technical Bar: Lead offensive architecture reviews and threat modeling sessions across core platforms, enforcing high benchmarks for resilience, monitoring, and defensive posture.

Talent Multiplier: Mentor and elevate senior and mid-level security engineers across the team. Delegate critical architectural tracks to foster growth, design interview standards for offensive and AI hiring, and build an environment grounded in psychological safety and high performance.

What We Are Looking For

Technical Qualifications

Offensive Security Track Record: Proven background operating as a Senior/Staff Offensive Security Engineer, Senior “Red Teamer”, or Principal Penetration Tester conducting complex assessments against web apps, APIs, distributed cloud environments, and internal networks.

AI & Agentic Architectures: Hands-on experience developing or architecting LLM-driven applications, agentic workflows, tool calling, autonomous agent sandboxing, and adversarial AI evaluation.

Cloud-Native & Container Mastery: Deep practical knowledge of container runtimes, Kubernetes architecture (RBAC, admission controllers, pod security standards, network policies, service mesh), and major cloud platforms. Demonstrated capability exploiting and hardening containerized infrastructure.

Software Engineering Fundamentals: Solid programming proficiency to build production-grade tooling, microservices, pipeline integrations, and custom agent skills.

Vulnerability Management & Detection Integration: Proven experience integrating offensive discoveries into enterprise vulnerability management engines (Jira, DefectDojo, or custom risk aggregators) and telemetry tools (SIEM).

Professional & Leadership Attributes (Banda 8 Alignment)

Cross-Department Influence: Demonstrated success leading initiatives that cut across engineering, product, and infrastructure boundaries, negotiating technical roadmaps, and resolving cross-system dependencies.

Business-Centric Mindset: Ability to evaluate technical risk through a business value and revenue-impact lens, prioritizing vulnerabilities that threaten platform trust, customer data, and transactional operations.

Communication & Presence: Exceptional verbal and written communication skills; experienced in presenting technical strategies to senior leadership and translating comple