Senior Cybersecurity Analyst

We are looking for a senior cybersecurity professional to establish and lead the security risk management for MedSimples' products and internal systems, which handle health and financial data, covering prevention, detection, and response. As the person building this function, you will lay the foundation: map the current exposure and establish detection and response processes.

Responsibilities

• Perform offensive security testing on web applications, APIs, mobile, and cloud infrastructure, including penetration testing, resource abuse, and resilience to automated attacks, with risk reports, evidence, and remediation recommendations.
• Evolve and promote, together with Infrastructure, Development, and Product teams, the SSDLC (Secure Software Development Life Cycle), including security requirements, processes, threat modeling, secure code review, and SAST/SCA/DAST integration into CI/CD
• Lead the AppSec (Application Security) program, including architecture reviews, API security, IAM, WAF, anti-abuse controls (rate limiting, usage limits, and cost monitoring), secrets management, and vulnerability lifecycle management with risk-based prioritization.
• Establish threat monitoring and detection and coordinate the incident response process, including containment, root cause analysis, post-mortems, and the incident communication workflow to authorities (e.g., ANPD).
• Support the DPO in executing the privacy program and in supporting technical communications with authorities (e.g., ANPD).
• Support maintaining compliance and audits (e.g., LGPD and ISO 27001), including producing evidence and documentation such as ROPA and RIPD/DPIA.

Requirements:

• Professional experience: hands-on experience in information security in production environments, preferably with software development teams.
• Secure development: knowledge of practices and methodologies such as SSDLC (Secure Software Development Life Cycle) or similar, threat modeling, and integration of security controls into CI/CD.
• Cloud security: experience with at least one public cloud provider (e.g., Azure, AWS, or GCP), including identity and access management and secure configuration of services.
• Application security: proficiency in the main classes of vulnerabilities in web applications and APIs (e.g., OWASP), experience with code and dependency analysis tools, and ability to review code in at least one modern language (preferably TypeScript and/or .NET).
• Detection and response: experience in monitoring, log analysis, and incident investigation, with knowledge of attack techniques and reference frameworks (e.g., MITRE ATT&CK).
• Privacy and data protection: practical knowledge of LGPD, including sensitive data processing, ROPA, and RIPD/DPIA.

You will stand out if you have:

• Previous experience in software development.
• Use of agents to accelerate code review, triage of SAST/SCA findings, alert analysis, and penetration testing
• Agent automation: building or orchestrating AI agents in security workflows, with initial operation in assisted mode, scope control, and audit trail.
• Agent governance: managing identities and permissions for AI agents, assessing risks of integrations and AI tools adopted by Engineering.
• Generative AI security: prompt injection, data leakage, abuse of tools and agents, and data poisoning
• Edge protection: experience with Cloudflare or similar WAF and CDN solutions.
• Security frameworks: knowledge of ISO 27001 and NIST CSF.
• Financial sector experience: PCI-DSS and/or Central Bank rules.
• Certifications such as CEH, eWPTx, OSWA, CBBH, OSCP, PNPT, GCIH, Security+, CySA+, AZ-500, or SC-200.

Benefits:

• 30-day paid leave
• Day off
• Bonus

Contractor (PJ) - Hybrid

Employment Type - Full-time

Industry - Financial Services

About MedSimples

MedSimples was created to simplify the financial lives of healthcare professionals and clients. With transparency, security, efficiency, and cutting-edge technology, we create value for our customers by offering management tools and services that help make their day-to-day easier. We are leaders in digital transformation in healthcare.

Our solutions include schedule and payment management, invoice collection and validation, accreditation of clinics and professionals, protocol-driven electronic medical records, and AI solutions for evidence-based medicine.

If you are someone looking to be in an environment of growth, innovation, and collaboration, come join our team! You will have the opportunity to work as a Senior Cybersecurity Analyst on the technology team.

Come build a successful career with us, submit your application, and make a difference!

💙 MedSimples: Brazil's best healthcare efficiency network 💙