{"id":3977104,"url":"https://alion.io/job/retorna-application-security-engineer-appsec-fintech","title":"Application Security Engineer - AppSec Fintech","company":{"id":686185,"name":"Retorna","domain":"retorna.app","url":"https://alion.io/company/retorna","size_band":"11-50","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Join","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["BR","CO","ES","CL","PE","VE"],"hiring_countries_total":6,"salary":null,"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"CIS Benchmarks","optional":false},{"name":"CloudFormation","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Jira","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-11-09T15:25:16Z","employer_posted_date":"2026-11-09","last_verified_at":"2026-11-09T18:29:33Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Sobre Retorna\nEn Retorna trabajamos por la democratización de las finanzas. Somos una fintech especializada en remesas y pagos transfronterizos, con operaciones en Chile, Colombia, Perú, Brasil, Venezuela y España, y un equipo 100% remoto. Estamos en una etapa de crecimiento acelerado y estamos fortaleciendo nuestra función de Ciberseguridad.\nSobre el rol\nReportarás al CISO y protegerás la nube y las aplicaciones web y móviles de Retorna. Buscarás vulnerabilidades antes que los atacantes, asegurarás nuestra infraestructura en AWS y trabajarás junto a los equipos de desarrollo para que el software se construya seguro desde el inicio. Colaborarás con Ingeniería, Plataforma/DevOps, IT, GRC y Riesgo Tecnológico.\nTareas\nRevisar y asegurar la configuración de AWS (IAM, redes, almacenamiento, cifrado y registros) y definir líneas base de hardening alineadas con CIS Benchmarks.\n\nMonitorear la postura de seguridad cloud (CSPM) y revisar la infraestructura como código (Terraform o CloudFormation) antes del despliegue.\n\nIntegrar SAST, SCA, detección de secretos y DAST en los pipelines de CI/CD.\n\nRealizar threat modeling y revisiones de código y APIs con foco en OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications y OWASP MASVS.\n\nAcompañar a los desarrolladores en la remediación y promover la cultura de desarrollo seguro con security champions.\n\nEjecutar pentests internos sobre aplicaciones web, móviles, APIs y cloud dentro de un alcance autorizado, y coordinar los pentests de proveedores externos hasta el retest.\n\nSimular técnicas basadas en MITRE ATT&CK en ejercicios de purple team para validar controles y capacidad de detección.\n\nGestionar el ciclo de vida de vulnerabilidades en Jira, desde la priorización por riesgo hasta la verificación del cierre, y aportar evidencia técnica a GRC para ISO 27001.\n\nRequisitos\n2 a 4 años de experiencia en ciberseguridad, con foco en seguridad cloud, seguridad de aplicaciones o pentesting.\n\nExperiencia práctica asegurando entornos en AWS (u otra nube pública, con disposición a trabajar en AWS).\n\nExperiencia ejecutando pentests sobre aplicaciones web y/o APIs y redactando informes con hallazgos y recomendaciones.\n\nConocimiento sólido de OWASP Top 10 y capacidad para explicar vulnerabilidades y su corrección a desarrolladores.\n\nLectura de código en al menos un lenguaje moderno y capacidad de escribir scripts.\n\nInglés técnico de lectura.\n\nSuma puntos si tienes:\nCertificaciones ofensivas (OSCP, eJPT/eCPPT, PNPT, BSCP) o cloud y defensivas (AWS Certified Security Specialty, CCSK, BTL1, GCIH).\n\nExperiencia en pruebas de seguridad de aplicaciones móviles (Android/iOS).\n\nExperiencia implementando DevSecOps en pipelines de CI/CD.\n\nExperiencia en fintech, banca o industrias reguladas.\n\nParticipación en bug bounty, CTFs o aportes a la comunidad de seguridad.\n\nBeneficios\nTrabajo 100% remoto desde LATAM.\n\nDías libres ilimitados.\n\nImpacto directo en la construcción de la función de Ciberseguridad de una fintech en crecimiento.\n\n¿Piensas como atacante, pero trabajas como aliado de los equipos de desarrollo? Postula y conversemos.","description_format":"text","description_chars":3117,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Spanish","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Brazil","iso":"BR","kind":"country"},{"name":"Colombia","iso":"CO","kind":"country"},{"name":"Spain","iso":"ES","kind":"country"},{"name":"Chile","iso":"CL","kind":"country"},{"name":"Peru","iso":"PE","kind":"country"},{"name":"Venezuela","iso":"VE","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Services","Application Security","Penetration Testing","Money Transfer & Remittances"],"lifecycle":[{"event":"open","at":"2026-11-09T18:29:33Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":25,"reasons":["conf:1","win:early"],"computed_at":"2026-11-09T20:02:43Z"},"pay":null,"html_url":"https://alion.io/job/retorna-application-security-engineer-appsec-fintech","json_url":"https://alion.io/job/retorna-application-security-engineer-appsec-fintech.json","meta":{"generated_at":"2026-11-09T20:02:43Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":6757,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-10T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":686185},"rest":"https://alion.io/mcp/rest/get_company?id=686185"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fretorna-application-security-engineer-appsec-fintech"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fretorna-application-security-engineer-appsec-fintech"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fretorna-application-security-engineer-appsec-fintech"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/retorna-application-security-engineer-appsec-fintech\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fretorna-application-security-engineer-appsec-fintech"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3977104}},{"tool":"search_jobs","arguments":{"company":"retorna.app","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3977104},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}