Grupo QuintoAndar | Senior Security Engineer - CSIRT

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/.

Location & Remote Work 

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

About the Position

Position Summary As a CSIRT Senior Engineer (SWE4), you will be the technical focal point and core pillar of the team during incidents. Beyond simply responding to alerts, your mission is to orchestrate defense by leading the complete response lifecycle: from analysis and forensic investigation support to making surgical containment and eradication decisions. Operating within a critical, high-availability ecosystem, you will serve as the bridge between tactical response and business continuity, ensuring not only swift operational recovery but also transforming every incident into actionable intelligence for the continuous evolution of our security posture.

Key Responsibilities

• Leadership in Critical and Complex Incidents: Serve as the primary technical point of contact during Level 2 and Level 3 security incidents, leading response efforts across complex, high-criticality environments.
• Partner Management and 24/7 Operations: Manage, mature, and coordinate responses alongside MSSPs and the 24/7 SOC, ensuring quality and alignment of actions.
• Cross-Functional Coordination: Coordinate efficiently and swiftly across multicultural teams and diverse business units (Legal, DPO, Communications, Cyber teams, etc.) during an incident.
• Playbook Development and Refinement: Create, maintain, and enhance Incident Response (IR) playbooks and procedures, integrating automation.
• DFIR and Post-Incident Analysis: Lead detailed forensic investigations to determine the root cause (Root Cause Analysis - RCA) and scope of compromise, facilitating meetings and preparing post-mortem documentation.
• Threat Detection: Advanced knowledge of threat detection, rule creation, and rule tuning/enhancement in SIEM and EDR.
• Cyber Threat Intelligence (CTI): In-depth mastery of the full CTI lifecycle, focusing on converting data into actionable intelligence to strengthen SOC routines.
• Vendor Management (Tier 1/Tier 2): Work in direct partnership with Tier 1 to optimize operational routines, maximizing value delivery from the active contract and vendor.

Qualifications and Required Skills

• Minimum Experience: At least 5 years of experience focused on Incident Response, Digital Forensics, or Threat Hunting.
• Essential Technical DFIR Mastery: Digital Forensics and Incident Response (DFIR) capability is essential. This includes the ability to preserve, collect, acquire, and analyze digital evidence across systems (Windows, Linux, macOS) as well as networks.
• Tool Proficiency: Proficiency in Memory Forensics and Host-Based Forensics tools.
• Basic Malware Analysis: Ability to perform basic static and dynamic analysis on malicious samples to extract IoCs and understand capabilities.
• Cloud Experience: Experience leading incident response in Cloud environments (AWS and GCP).
• Automation (SOAR): Proven experience with SOAR and building workloads that drive efficiency into the Incident Response process.
• Risk Management and Prioritization: Sharp risk perspective and the ability to prioritize actions and resources under pressure.
• Communication and Leadership: Proven ability to make fast decisions in high-pressure situations and excellent communication skills to articulate technical findings to both technical and executive audiences.

Benefits

• Competitive salary
• Profit sharing
• Meal allowance 
• Health insurance
• Dental plan
• Life insurance
• Childcare subsidy and Atypical Parenthood subsidy
• Wellhub
• Home office allowance
• Employee assistance program (mental health, social, legal, and financial support)
• Extended parental leave
• Day off on birthday, Mother’s Day, and Father’s Day
• Benefits Club (discounts on everyday services)
• Discounts at educational institutions
• Reading kit for children – PlayKids

Diversity & Inclusion at Grupo QuintoAndar

We value diversity and want everyone to feel welcome here, regardless of their age, gender identity, sexual orientation, race, color, ethnicity, origin, disability, religion, or any other characteristic. All our job openings are open to all individuals!

You'll notice there are some diversity questions in the application form. For affirmative action roles, this information may be used to verify your alignment with the target audience for the opportunity. In such cases, it may be used for elimination purposes. For non-affirmative action roles, this data will be used anonymously, exclusively to monitor and improve our inclusion practices in the hiring process, and will have no impact on your application.

Privacy and Data Protection

The Grupo QuintoAndar operates in compliance with privacy and data protection laws, including, but not limited to, the Brazilian General Personal Data Protection Law (LGPD) (Law No. 13,709/2018), and ensures the security of your data. To learn more, please access our Privacy Notice for Candidates. For questions or to exercise your rights as a data subject, please contact us through our Service Channel.