Senior Full-Stack Security Engineer - International Project

Do you love technology, enjoy complex challenges, and have a keen eye for finding and resolving vulnerabilities? Then this opportunity might be the next big challenge of your career!

We are looking for a Senior Engineer with strong experience in React and Node.js and solid performance in application security, capable of analyzing source code, identifying vulnerabilities, understanding attack paths, developing code, operating development tools, and executing complex cybersecurity tasks. This person will be responsible for leading the remediation of security vulnerabilities in front-end web applications, from the identification and validation of the problem to the proven closure of the vulnerability in the source code stored in Bitbucket. The professional must analyze vulnerabilities affecting React and Node.js applications, determine their exploitability and business impact, implement secure fixes, add security regression tests, validate changes through scans in the CI/CD process, and provide clear evidence that the vulnerability has been corrected and properly closed.

The position requires interaction with international teams, making advanced English necessary for daily communication.

Responsibilities and assignmentsIn your work routine, you will encounter the following activities: Review and validate security vulnerabilities identified in React, TypeScript, JavaScript, and Node.js code.

Trace vulnerabilities from the source code in Bitbucket to API calls, browser behavior, and deployment configurations.

Implement fixes for vulnerabilities in front-end and Node.js applications.

Use AI for analyzing large codebases.

Work with security controls for AI agents capable of interacting with corporate systems.

Create unit, integration, end-to-end (E2E), and security regression tests.

Rerun security scans and provide evidence for the closure of vulnerabilities in tools such as Jira, Security Workbench, Archer, or equivalent systems.

Work together with developers, Product, AppSec, QA, DevOps, and Platform Security teams.

Identify recurring vulnerability patterns and create reusable secure development guidelines or automated fixes.

Enhance security controls in pull requests, branch policies, build pipelines, and release gates.

Investigate false positives and document risk-based decisions when a fix cannot be implemented immediately.

Support security reviews, penetration testing, incident-driven fixes, and vulnerability trend monitoring.Requirements and qualificationsMANDATORY KNOWLEDGE AND SKILLS:Strong experience in security for Node.js services, APIs, and Backend-for-Frontend (BFF) applications.

Knowledge of React components, hooks, context, routing, state management, and, when applicable, server-side rendering (SSR).

Knowledge of secure handling of user-controlled data in components, forms, URLs, query parameters, and client-side states.

Ability to analyze pull requests, branches, commit history, and repository configurations.

Familiarity with common security risks in React applications, including: Cross-Site Scripting (XSS) caused by insecure rendering.

Insecure use of dangerouslySetInnerHTML. DOM-based XSS.

Client-side open redirects.

Insecure use of browser storage.

Exposure of sensitive information in source maps or generated/bundled files.

Absence of security headers or insecure Content Security Policy (CSP) configuration.

Authorization controls applied only to the user interface.

Data leakage through client cache, exports, logs, or error messages.

Vulnerabilities related to dependencies and the software supply chain.SECURE HANDLING OF: SQL and NoSQL queries.

Command execution.

File uploads and downloads.

Path and URL parameters.

HTTP headers.

Serialization and deserialization.

Session and token management.

External requests sensitive to SSRF (Server-Side Request Forgery). Security tools and corporate scanners — SAST and code qualityExperience with tools such as: Checkmarx

Veracode

Fortify

SonarQube

Snyk Code

Semgrep Mandatory experience:5+ years of experience in front-end or full-stack software engineering. 3+ years working directly with application security, secure coding, or vulnerability remediation in DevSecOps environments.

Strong experience with React, TypeScript, JavaScript, Node.js, HTML, CSS, and HTTP.

Experience working with Git and Bitbucket in corporate environments.

Proven experience tracking vulnerabilities from identification to correction and closure validation.

Experience with web applications handling sensitive data.

Ability to act together with application, security, QA, DevOps, and infrastructure teams. DIFFERENTIALS: Experience with security for AI assistants or autonomous agents.

Experience with AI agents for code development.

Experience with agentic software-development platforms.

Experience with LLM (Large Language Models) security.

Experience with GitHub, GitLab, or other corporate development platforms.

Experience in information security research.

Experience in creating security automation.

Experience using AI for vulnerability discovery and remediation. Additional informationDeliver IT is going to leave its mark on this project and wants to invite you to be part of this construction! 🙆‍♀️We have a light, relaxed, collaborative, and diverse culture, as well as an enriching environment, with many experts in various segments and many challenges. Here you will find innovative projects, connection, and a lot of knowledge exchange! 😊All our positions follow the CLT contract model at 44h/week.CHECK OUR BENEFITSModality: 100% Remote VA and/or VR Well-being Program: psychological support, legal support, social support, financial support. Health and Dental Plans Life Insurance Wellhub Partnerships that give you discounts: Sucesu, Target Trust, Sesc, and Seprorgs Anniversary award Referral award Daycare allowance