Application Security Engineer

Lucas Reis de Oliveira da Silva · Santo André, SP

Security that moves with the product.

I work across security reviews, threat modeling, vulnerability management, and offensive testing to help teams turn security findings into product decisions they can act on.

View my work Read the blog

lucas@security — zsh

lucas@security ~ % nmap -sV --script http-title app.test

443/tcp open https nginx 1.24.0

|_http-title: Product Gateway

lucas@security ~ % sqlmap -u "https://app.test/item?id=1" --batch --level=1

[INFO] testing GET parameter 'id'

[WARNING] parameter 'id' does not appear to be injectable

lucas@security ~ % semgrep scan --config auto src/

Scanning 42 files with 1,248 Code rules

Ran 1,248 rules on 42 files: 0 findings

lucas@security ~ %

Selected work

From findings to decisions.

Experience across product security, offensive testing, security operations, applied cryptography, and community leadership.

Sep 2026 — Present
São Paulo, SP
Cybersecurity Engineer
Mercado Livre
- Manage security risk for Point devices across product and engineering contexts.
- Lead security reviews and threat-modeling sessions for product changes.
- Coordinate vulnerability remediation with product and engineering teams.
Oct 2024 — Sep 2026
São Paulo, SP
Application Security Engineer
PagBank
- Performed mobile, API, web, and GraphQL penetration tests guided by OWASP practices.
- Applied threat modeling, SAST, DAST, DevSecOps, and cloud-security techniques.
- Worked with a security team specialized in iOS and Android products.
Nov 2023 — Jul 2024
São Paulo, SP
Cyber Security Trainee
Go Ahead IT
- Administered IBM QRadar SIEM and developed Python-based security playbooks.
- Applied MITRE ATT&CK knowledge and AWS fundamentals in operational security work.
- Built a broader business view through rotations across networks, data center, collaboration, contracts, and security.
Nov 2022 — Nov 2023
Santo André, SP
Scholarship Research (PDPD)
Federal University of ABC (UFABC)
- Analyzed cryptographic blocks across algorithms and modes of operation.
- Implemented AES and TEA experiments in C using ECB, CTR, and CBC modes.
Sep 2022 — Present
Santo André, SP
Information Security Coordinator
Green Team Hacker Club — UFABC
- Coordinate the team and teach web hacking, cryptography, forensics, binary exploitation, and reverse engineering.
- Compete in capture-the-flag challenges and help new members build practical security skills.

Latest writing

Notes from the work.

Latest

October 9, 20265 min read

Review CWES

In this article, I share my experience with the Hack The Box CWES certification, covering the course, labs, preparation, and exam. I also discuss which experience levels I think the certification is best suited for and share a few tips that helped me during my studies and while writing the final report.

CWES
Certificate
Study

Read article

About

Practical security, shared clearly.

I work across security reviews, threat modeling, vulnerability management, and offensive testing to help teams turn security findings into product decisions they can act on.

I am growing as a security engineer by going deeper into penetration testing, strengthening how security supports product delivery, and building toward technical leadership.

Lucas ReisApplication Security Engineer

Academic background

Foundations for the next problem.

Bachelor of Computer Science
Federal University of ABC
Expected 2026
Computer Networks Technician
SENAI-SP
2019 — 2020

Credentials

Learning that compounds.

ISC2
Certified in Cybersecurity
Mar 2023
Cisco
Networking and cybersecurity learning paths
CCNA, Junior Cybersecurity Analyst, Network Technician, Cloud Security, CyberOps, Introduction to Cybersecurity, and Learn-A-Thon 2020.
University of Cambridge
B1 English Certificate
Dec 2019

Contact

Let’s make the next release safer.

Santo André, SP

contato@lucas-reis.com LinkedIn GitHub X

Security that moves with the product.

From findings to decisions.

Cybersecurity Engineer