Security Engineer

Security Engineer

At Toku, we are looking for a Security Engineer: someone who enjoys breaking our systems to make them stronger and, at the same time, builds the policies, processes, and certifications that maintain security over time.

The Security team today combines 5 fronts (AppSec, cloud, SecOps, IT/IAM, and GRC), and we are looking for someone who can contribute to more than one of these aspects.

We value curious and proactive people who adapt quickly to change, think creatively, enjoy working in a team, and are not afraid to challenge the status quo.

Main responsibilities

Product and development security

• Support the implementation of security improvements in the development cycle: code and design review, threat modeling, and WAF management.
• Execute or coordinate penetration tests and recurring vulnerability scans, and assist development teams in remediating findings.
• SIEM/SentinelOne alert triage, scans and remediation tracking, user provisioning/deprovisioning and access reviews, patching and endpoint posture, PCI/ISO evidence collection, client questionnaires, support for pentests and validation of fixes.

Cloud security

• Participate in the design of solutions in GCP/AWS, manage configurations, and automate controls.
• Monitor cloud security posture (CSPM) and respond to vulnerabilities or incidents in that environment.

Security operations and incident response

• Monitor the SIEM and other tools, investigate alerts, and lead technical incident response.
• Fine-tune correlation rules and propose new detection use cases based on threat intelligence.
• Follow new attack and fraud trends, patch systems against critical vulnerabilities, and adjust controls based on new modus operandi.

Corporate security and access

• Manage the security of equipment and internal networks: antivirus/EDR, patches, and secure operating system configurations.
• Manage additions, removals, and changes of privileges, maintain IAM tools, and apply adjustments arising from periodic reviews.

Governance, risk, and compliance

• Maintain and update policies and procedures, and verify their compliance.
• Support PCI DSS and ISO 27001 certification processes: evidence collection and documentation of controls.
• Identify, manage, and mitigate security risks in the organization.

Ideal profile

• +2 years of experience in security, IT, or infrastructure; foundations in networking, Linux, and GCP/AWS; organized and good documentation skills; desire to learn. Desirable: SIEM/EDR, having participated in PCI/ISO audits, Security+/eJPT or similar.
• Desirable technical knowledge in payments and cash flow, cards, processing, payment methods, among others.
• Regional scope desirable: if you have worked for other countries, such as Brazil and/or Mexico, we see it as a great plus.
• Experience documenting processes and controls.
• Excellent communication skills and ability to work in a team.
• Motivation and passion for technology and cybersecurity.
• Autonomy, adaptability, and full-time availability.

If you meet these requirements and are interested in joining our development team at Toku, we look forward to your application!