01
TRCI-26-06246
Application Security Analyst (AppSec)
Contract Application Security Analyst (AppSec) needed in São Paulo (3–6 years, ideally 5+) to assess security of web apps, APIs, Android/iOS mobile and legacy client-server systems. You will run security assessments (SAST/DAST/code review), perform threat modeling and risk analysis, review architecture and security requirements, validate fixes, and guide development teams on remediation and secure development best practices. Strong knowledge of OWASP standards, authN/authZ protocols (OAuth2/OIDC/JWT/SAML), networking/crypto/TLS, and compliance (LGPD/PCI-DSS/ISO 27001) is required; cloud security and common AppSec tools are a plus.
Position summary
- Location
- Brazil
- Workplace
- Hybrid
- Employment
- Contract
- Experience
- Minimum 3 years and Maximum 6 years
Role overview
Why This Role Matters.
Contract Application Security Analyst (AppSec) needed in São Paulo (3–6 years, ideally 5+) to assess security of web apps, APIs, Android/iOS mobile and legacy client-server systems. You will run security assessments (SAST/DAST/code review), perform threat modeling and risk analysis, review architecture and security requirements, validate fixes, and guide development teams on remediation and secure development best practices. Strong knowledge of OWASP standards, authN/authZ protocols (OAuth2/OIDC/JWT/SAML), networking/crypto/TLS, and compliance (LGPD/PCI-DSS/ISO 27001) is required; cloud security and common AppSec tools are a plus.
Your Impact
Deliver Enterprise Value
Help organisations solve complex business problems through modern technology, consulting expertise and measurable outcomes.
Collaboration
Work Across Teams
Collaborate with consultants, architects, engineers and client stakeholders throughout the project lifecycle.
Growth
Learn Continuously
Gain exposure to enterprise technologies, certifications, mentoring and real-world project experience.
Career Path
Grow With Ubique
Build a long-term consulting career with opportunities to take on greater responsibility and leadership over time.
Responsibilities
What You'll Be Doing.
Every role at Ubique contributes directly to solving meaningful business challenges for our clients.
02
Identify vulnerabilities and support development teams in defining corrective actions.
03
Conduct reviews of architecture and security requirements for new systems and functionalities.
04
Produce technical documentation and disseminate good practices for safe development.
Technology stack
Tools & Technologies.
The platforms and technologies you'll use to build modern, enterprise-grade solutions.
01
AppSec
Required
02
Application Security
Required
03
SAST
Required
04
DAST
Required
05
Secure Code Review
Required
06
Threat Modeling
Required
07
OWASP Top 10
Required
08
OWASP ASVS
Required
09
OWASP API Security Top 10
Required
10
OWASP Mobile Top 10
Required
11
OAuth 2.0
Required
12
OpenID Connect
Required
13
OIDC
Required
14
JWT
Required
15
SAML
Required
16
TLS
Required
17
Cryptography
Required
18
API Security
Required
19
Web Security
Required
20
Android Security
Required
Requirements
Skills & Experience.
We value curiosity, collaboration and continuous learning. If you don't meet every requirement but believe you can make an impact, we'd still love to hear from you.
Essential
Required Qualifications
Application Security (AppSec) experience (3+ years)
Security assessments for web applications
API security assessment
Mobile application security assessment (Android and iOS)
Security assessment of legacy client-server applications / hybrid environments
Vulnerability identification and remediation support
Architecture and security requirements review
Secure code analysis / code review
Security testing and fix validation
Threat Modeling and application risk analysis
OWASP Top 10
OWASP API Security Top 10
OWASP Mobile Top 10
OWASP ASVS
Authentication/authorization protocols: OAuth 2.0, OpenID Connect, JWT, SAML
Networking fundamentals for security
Cryptography fundamentals
TLS and secure communication protocols
Knowledge of compliance/security frameworks: LGPD, PCI-DSS, ISO 27001
Familiarity with AppSec tools: SAST and DAST (and code review tooling/process)
Preferred
Nice to Have
Cloud security knowledge (Azure, AWS, OCI, or GCP)
Experience with Burp Suite
Experience with Checkmarx
Experience with Fortify
Experience with Veracode
Experience with SonarQube
Experience with Jira and/or Confluence
Basic reverse engineering of mobile or desktop applications
Certifications: CSSLP, GWAPT, GWEB, GMOB, OSWE, CISSP (or equivalent)
Secure code review experience in Java,.NET, Node.js, or Python
Mobile security tooling: MobSF, Frida, Objection, Jadx
Acting as Security Champion / technical reference / internal AppSec consultant
Participation in defining secure development standards and corporate SSDLC programs
What you'll gain
More Than Just A Job.
We're committed to helping every team member grow professionally, personally and technically while working on meaningful projects.
Global Exposure
Collaborate with international clients and multicultural teams on enterprise programmes.
Continuous Learning
Expand your expertise through mentoring, certifications and hands-on project experience.
Career Growth
Take ownership, develop leadership skills and grow your consulting career over time.
Flexible Working
Hybrid and remote collaboration designed around trust and delivering exceptional outcomes.
People First
Join a supportive culture where collaboration, respect and long-term relationships come first.
Enterprise Projects
Work on meaningful technology initiatives for leading organisations across industries.
Apply
Apply for Application Security Analyst (AppSec)
One page, about two minutes. We only ask for what we actually need to have a first conversation.