Purple Team Security Engineer
São Paulo • Full time • Hybrid
Attack and defend Nova, the AI-powered payment network built on Pix and Open Finance: emulate adversaries, turn findings into detections, and secure our AI agents. Reports to the Head of Engineering.
About Nova
Nova is building a new-generation payment network using AI on top of Pix and Open Finance. Backed by Monashees, Canary, Canaan and Propel, we recently raised a large Series A and are assembling a small team of exceptional people.
Learn more about us
The role
Reporting to the Head of Engineering, you'll attack and defend Nova's payment network, working closely with the founders and the engineers who own each service. You'll emulate the adversaries that target Brazilian fintechs, turn every finding into a detection or a control, and secure the AI agents that take authenticated actions on customer accounts.
What you'll do
- Build and tune detections as code across our cloud, Kubernetes, application and payment telemetry, with coverage tracked against MITRE ATT&CK
- Run adversary emulation against our own systems: account takeover, synthetic identity, authorization/capture race conditions, replay and idempotency abuse
- Red-team our AI agents and LLM features (prompt injection, tool-use abuse, data exfiltration), and design guardrails for authenticated AI actions
- Harden the platform: IAM least privilege, secrets, network segmentation, CI/CD and supply-chain controls, plus a threat model for each new service
- Lead incident response end to end, and map our controls to PCI DSS, LGPD and Banco Central requirements as we move toward our own licenses
- Teach and multiply: pair with engineers, run tabletop exercises and make the secure path the easy path
What we're looking for
- 5+ years in security engineering on both sides: offensive engagements and building or operating detection and response
- Hands-on experience securing or attacking LLM-based systems; you know the OWASP Top 10 for LLM Applications and MITRE ATLAS
- Strong Python and Bash, and the ability to ship production code in a compiled language (we use Go; Go itself is not required)
- Practical AWS, Kubernetes and API security, and experience leading incident response on systems that handle money or customer data
- You use AI daily in your work
- Bonus: fintech or payments experience in Brazil, PCI DSS or Banco Central processes, OSCP/OSEP/GCIH or a public track record (CVEs, bug bounties, talks)
Selection process
HR screening (15 min) → Hiring manager intro (30 min) → Deep dive (60 min) → Bar raiser (45 min) → Culture fit with our CEO (30 min)
What we offer
- PJ contract
- Aggressive stock options
- Premium health insurance, flexible hours, paid vacation and Wellhub