Unico ID
Cyber Security Engineering Specialist II
CurrentApril 2026 - PresentSão Paulo/SP - BrazilRemoteI serve as the primary security reference for the products within my scope, representing Product Security in discussions with senior leadership, Engineering, Staff Engineers, Architecture, Product, and other stakeholders.
I lead Architecture Reviews, Design Reviews, and Threat Modeling from the architecture and design stages, contributing to product security decisions, defining security requirements, technical standards, and mitigation strategies, and supporting leadership go/no-go decisions.
I provide technical leadership through influence, connecting technical risks with product and business needs and helping teams make decisions that consider security, architecture, user experience, technical feasibility, and organizational priorities.
Within Product Security, I assess business logic, abuse scenarios, authentication, authorization, fraud, and non-obvious exploitation paths, along with penetration testing in critical or complex scenarios. In biometrics and liveness, I lead adversarial assessments involving Presentation Attack Detection (PAD), Injection Attack Detection (IAD), bypass scenarios, fraud, and abuse.
I also work on Vulnerability Management, prioritizing risks based on severity, exploitability, and business impact, while supporting SLAs, metrics, exceptions, and risk acceptance.
In AI/LLM Security, I assess applications and AI agents for risks such as prompt injection, data leakage, tool abuse, excessive agency, and Shadow AI, supporting the definition of guardrails and security requirements.
For specialized assessments, I define strategy and scope, coordinate with teams such as Red Team, and support mitigation decisions.
Cyber Security Engineering Specialist I
October 2024 - March 2026São Paulo/SP - BrazilRemoteI served as a technical reference in Application Security and Product Security, with autonomy and ownership over assessments, technical decisions, and the evolution of security practices alongside Engineering teams.
I conducted advanced web and API penetration testing, code review, threat modeling, and business logic assessments, identifying technical vulnerabilities and risks related to fraud, abuse, financial loss, and data exposure that are not always detected by automated tools.
I continued evolving the SSDLC and DevSecOps controls implemented previously, improving processes, integrations, and the way risks were handled throughout the development lifecycle.
I developed Python automations to integrate platforms and improve Security Engineering workflows. This included designing and building AI-powered solutions from scratch to support Architecture Reviews and Threat Modeling, as well as automations for consolidating, enriching, prioritizing, and triaging information from SAST, SCA, and IaC scanning solutions.
I also architected and developed from scratch a corporate solution for secure, bidirectional file transfer between Unico and its customers, used across different areas of the organization and avoiding the need for a commercial tool for this use case.
I worked with Cloudflare across key company resources, implementing and tuning WAF rules, rate limiting, bot protection, and DDoS protections to strengthen the security and resilience of internet-facing applications and APIs.
My work also included Cloud Security in GCP, Bug Bounty, application and API protection, Security Champions, and the evolution of security controls with development teams.
Senior Cyber Security Engineer
August 2023 - September 2024São Paulo/SP - BrazilRemoteI worked on building and evolving Unico's Application Security program, with direct ownership of the design and implementation of the SSDLC from the ground up.
I designed and implemented security controls, automations, and integrations across the development lifecycle, including SAST, SCA, IaC scanning, and secret scanning in CI/CD, along with complementary DAST practices and manual assessments.
The model was deployed at organizational scale, reaching more than 1,000 repositories used by over 300 developers, with centralized guardrails applied across the company.
The implemented controls included enforcement mechanisms capable of blocking merges when High/Critical vulnerabilities are identified, supported by structured processes for false-positive analysis, exceptions, and risk acceptance.
I also conducted web and API penetration testing, code review, security assessments, and risk-oriented analyses, helping bring security closer to Engineering workflows and strengthen the DevSecOps culture.
