Application Security Engineer at Nubank, the leading digital bank in Latin America serving 140 million customers across Brazil, Mexico, and Colombia. The role involves enabling secure software development practices across Nubank’s engineering organization, supporting teams working with a diverse technology stack including Clojure, Python, Go, Kotlin, Swift, and Dart.
🏢 About Nubank
Nu is the leading digital bank in Latin America, serving 140 million customers across Brazil, Mexico, and Colombia. The company has been leading an industry transformation by leveraging data and proprietary technology to develop innovative products and services. Guided by its mission to fight complexity and empower people, Nu caters to customers’ complete financial journey, promoting financial access and advancement with responsible lending and transparency.
🎯 The Role
As a Security Engineer in our Application Security (AppSec) team, you will be part of the group responsible for enabling secure software development practices across Nubank’s entire engineering organization. We support teams working with a diverse technology stack – including Clojure, Python, Go for backend and Kotlin, Swift, Dart for mobile – by embedding security into their SDLC. This role is ideal for someone with a strong foundation in application security concepts, who enjoys working closely with engineering teams to drive security best practices, and who has a keen interest in emerging areas such as AI security and threat modeling.
✅ Key Responsibilities
Embed security practices into the SDLC across backend, mobile, and web applications.
Deploy and maintain security tools (SAST, DAST, SCA, MAST) in CI/CD pipelines.
Perform threat modeling and security reviews for new and existing projects.
Develop scripts and tools (Python, Go, Bash) to automate security checks and processes.
Collaborate with engineering teams to explain and remediate vulnerabilities.
Support AI-related security initiatives, ensuring safe adoption of ML/AI features in products.
Contribute to the evolution of internal security guidelines and baselines.
Participate in cross-functional discussions to align security requirements with business goals.
📌 Required Qualifications
Solid understanding of application security concepts and secure software development practices.
Hands-on experience with CI/CD pipelines and implementing security tools (e.g., SAST, DAST, SCA).
Knowledge of scripting/programming with commonly used languages like Python, Go, bash, etc for automation and tooling.
Familiarity with container security tools (e.g., Trivy, Aqua).
Experience working with modern software architectures: Web, Mobile, APIs, and MCPs.
Strong communication and collaboration skills to work with multi-disciplinary teams.
⭐ Desirable Experience
Previous experience conducting security assessments in distributed systems environments.
Experience with tools like Semgrep, Fortify, Checkmarx, Veracode.
Experience with pipeline tools like Github Actions, Gitlab Workflow, others.
Experience with AI security concepts and emerging AI/ML security risks.
