Security Engineer (Early Career)

What you'll do

You will rotate across the security function in your first year, with real ownership from the first month. Expect the mix below to shift as the business does.

Secure the AI posture, without blocking it

• Review how teams use LLMs, coding agents and AI tooling (Claude, agentic browsers, internal inference gateways) and help define guardrails that protect data without killing adoption
• Operate our LLM-based investigation agent on the SIEM: catch hallucinated attributions, noisy alerts and conclusions the underlying data doesn't support, and tune its instructions before they reach production
• Develop the core skill of this role: knowing when to trust an AI-generated result and when to verify it by hand
• Help build our view of prompt injection, data exfiltration through AI tools, and model/agent permissions as first-class risks

Cloud security on AWS and GCP

• Triage findings from AWS GuardDuty, GCP Security Command Center, IAM and network configuration reviews
• Run configuration and posture checks, and drive fixes with the owning teams instead of just filing tickets
• Contribute to our large-scale GCP project inventory and cleanup, and keep the central findings tracker honest
• Learn Auth0, Cloudflare and Google Workspace security controls as they apply to identity, edge and SaaS

Secure code and CI/CD

• Review internal tools, scripts and pull requests for the classics: hardcoded credentials, unsafe input handling, over-broad permissions, secrets in pipelines
• Own SonarQube and dependency-scanning results for internal repositories: prioritize CVEs, follow up with developers, close the loop
• Review CI/CD changes that touch security-sensitive configuration (secrets, deployment access, IAM bindings)
• Help push secure-by-default patterns into how engineers actually work, including the code they generate with AI

Detection, response and triage

• Write and refine Splunk queries to investigate alerts from identity/SSO, cloud, endpoint, email and network sources
• Maintain detection rules and dashboards; hunt down false positives and false negatives
• Reconstruct user activity timelines across systems and document findings with evidence, not just conclusions
• Monitor the EDR console, investigate suspicious endpoints, and execute containment (host isolation, quarantine) with a senior engineer
• Triage phishing reports, analyze URLs and attachments in sandbox and threat-intel tools, maintain email and web filtering policies, and run phishing simulations
• Escalate fast and clearly when a finding exceeds what you can close on your own, and work incidents through incident.io

What we look for

• 1–2 years in security, IT, software engineering or a related technical role. Internships, CTFs, bug bounties, open-source contributions and serious personal projects all count.
• Working knowledge of at least one of AWS or GCP: you know what IAM, security groups/VPC firewall rules, and a service account are, and you want to go much deeper
• Comfort in the command line (bash), reading JSON and logs, and reading code in at least one common language (Python, JavaScript, Go) well enough to spot an obvious security issue
• Basic familiarity with a log query language (SPL, KQL or similar), or the drive to become fluent quickly
• Conceptual understanding of identity and authentication: OAuth, SSO, MFA, service-to-service auth
• Hands-on experience using generative AI tools in a technical context, and a healthy skepticism about their output
• A verify-before-you-conclude instinct: you never take a tool's, a vendor's or an AI agent's answer at face value without evidence
• Strong written communication in Spanish and English. Much of this job is explaining findings clearly to people who aren't security engineers.
• Comfort with ambiguity and pace: priorities change, the stack evolves, and you'd rather learn on the job than wait for a course

Nice to have

• Prior exposure to a SIEM, EDR console (CrowdStrike, SentinelOne, Defender) or email/web security platform
• Python or JavaScript for scripting and automation
• Any experience with SAST/dependency scanning tooling, secrets management or CI/CD security
• Experience prompting or building with LLM APIs, agents or MCP tooling
• Entry-level certifications (Security+, AWS Cloud Practitioner, Google Cloud Digital Leader / Associate Cloud Engineer, or similar)
• Portuguese

What you'll get

• Exposure to the full security surface of a regulated fintech in your first year: cloud, code, detection, response, compliance and AI, rather than a single queue
• A senior team that pairs with you on investigations and reviews, and expects you to push back when the evidence doesn't hold
• Direct work on problems most security teams haven't solved yet: securing agentic AI in production
• A modern stack: AWS, GCP, Splunk, Auth0, Cloudflare, SonarQube, incident.io, Claude and internal AI tooling
• Budget and time for certifications, conferences and the hacker community
• Fast, transparent hiring: application review, a technical conversation about real scenarios (no gotcha puzzles), a practical exercise you can do in a few hours, and a conversation with the team

How to stand out

Send us something you've built, broken or written: a repo, a CTF write-up, a bug report, a blog post, a detection rule. We care far more about how you think and how you learn than about the exact list of tools on your CV.

Where we work

This is a remote-first role: you'll work from home day to day. You'll ramp up in person with the team, and come together in person for team moments, events and customer visits through the year.