Staff Security Engineer | Application Security

Your wellbeing, our mission. Join a company shaping a healthier world. GET TO KNOW US At Wellhub we're revolutionizing workplace wellness. Our platform connects employees worldwide to the best partners for fitness, mindfulness, therapy, nutrition, and sleep—all in one simple subscription. Headquartered in NYC with team members in Europe, North America and South America, we’re on a mission to make every company a wellness company. We believe work should be fulfilling, inspiring, and balanced. Here, you’ll find a team that values wellbeing, collaboration, and different perspectives, where passion and creativity push boundaries to create real impact. Your contributions will help shape a healthier, more balanced world for you and millions of people globally. Join us in redefining the future of wellbeing! THE OPPORTUNITY We are hiring a Staff Security Engineer | AppSec to our Information Security team in Brazil! This is a Remote – Brazil position, meaning you can work from anywhere within the country. Please note that this role is only open to candidates in Brazil. The Information Security team is responsible for protecting our subscription-based product serving millions of users. As a Staff Security Engineer, you will own multiple security domains end-to-end — your center of gravity will likely be software security (secure SDLC, vulnerability management, threat modeling, pentesting, and red teaming), while the role also reaches into incident response, threat intelligence, cloud security, and compliance/GRC as the team's mandate requires. You will become the team's go-to authority for the hardest security trade-offs — the ones that cut across domains and don't have an obvious owner. With deep hands-on expertise in one or more of these sub-domains and working familiarity across the rest, you will connect pentest findings, incident root causes, compliance requirements, and cloud misconfigurations into a unified risk strategy — bringing threat intelligence and compliance into day-to-day engineering decisions and raising the security bar across the organization. YOUR IMPACT Own multiple security domains end-to-end (e.g., application security, threat intelligence, detection engineering, cloud security posture), navigating cross-team dependencies and understanding the tech stacks you're protecting. Lead system and architectural reviews and threat modeling for high-risk projects, enforcing secure-by-design standards, setting secure-coding benchmarks, and reinforcing the use of company-standard security platforms and controls. Scope, hire, or directly run pentests and red team exercises against critical systems, driving root-cause fixes directly with engineering rather than letting findings pile up as backlog. Own and drive the resolution of complex, cross-service vulnerabilities and security incidents, coordinating multiple engineering teams, communicating status to stakeholders, and turning postmortems into concrete guardrails that prevent recurrence and improve detection/response maturity. Set and enforce clear security KPIs, SLAs, and SLOs across the domains you touch (e.g., detection and response times, patch/remediation windows, cloud posture drift), building the monitoring and alerting needed to hold the organization accountable. Drive architecture decisions across interconnected systems to reduce security debt, anticipating where technical debt introduces risk and proactively addressing it. Plan and execute security-relevant migrations and platform updates (identity, cloud, key management, etc.) seamlessly, preserving data integrity and security guarantees throughout. Manage end-to-end delivery of medium-to-large security initiatives (e.g., a red team program buildout, removal of classes of vulnerabilities, a compliance audit, a zero-trust rollout, a cloud security hardening effort, or a detection coverage program), balancing quick wins with long-term risk reduction. Live the