<div class="content-intro"><p><strong>Clara is the leading platform in Latin America for companies to execute and manage every payment operation.</strong> More than 50,000 leading and fast-growing businesses run on our corporate cards, bill pay, financing and B2B payments, and in 2025 the Financial Times named Clara the region’s fastest-growing company. We’re passionate about helping every company we work with become more effective—and, through that, raising the region’s competitiveness. We’re ~400 people, backed by Notable Capital, Coatue, Kaszek, monashees, DST Global, ICONIQ, General Catalyst and Goldman Sachs, among others.</p></div><h1>Security Engineer (Early Career)</h1> <h2>What you'll do</h2> <p>You will rotate across the security function in your first year, with real ownership from the first month. Expect the mix below to shift as the business does.</p> <p><strong>Secure the AI posture, without blocking it</strong></p> <ul> <li>Review how teams use LLMs, coding agents and AI tooling (Claude, agentic browsers, internal inference gateways) and help define guardrails that protect data without killing adoption</li> <li>Operate our LLM-based investigation agent on the SIEM: catch hallucinated attributions, noisy alerts and conclusions the underlying data doesn't support, and tune its instructions before they reach production</li> <li>Develop the core skill of this role: knowing when to trust an AI-generated result and when to verify it by hand</li> <li>Help build our view of prompt injection, data exfiltration through AI tools, and model/agent permissions as first-class risks</li> </ul> <p><strong>Cloud security on AWS and GCP</strong></p> <ul> <li>Triage findings from AWS GuardDuty, GCP Security Command Center, IAM and network configuration reviews</li> <li>Run configuration and posture checks, and drive fixes with the owning teams instead of just filing tickets</li> <li>Contribute to our large-scale GCP project inventory and cleanup, and keep the central findings tracker honest</li> <li>Learn Auth0, Cloudflare and Google Workspace security controls as they apply to identity, edge and SaaS</li> </ul> <p><strong>Secure code and CI/CD</strong></p> <ul> <li>Review internal tools, scripts and pull requests for the classics: hardcoded credentials, unsafe input handling, over-broad permissions, secrets in pipelines</li> <li>Own SonarQube and dependency-scanning results for internal repositories: prioritize CVEs, follow up with developers, close the loop</li> <li>Review CI/CD changes that touch security-sensitive configuration (secrets, deployment access, IAM bindings)</li> <li>Help push secure-by-default patterns into how engineers actually work, including the code they generate with AI</li> </ul> <p><strong>Detection, response and triage</strong></p> <ul> <li>Write and refine Splunk queries to investigate alerts from identity/SSO, cloud, endpoint, email and network sources</li> <li>Maintain detection rules and dashboards; hunt down false positives and false negatives</li> <li>Reconstruct user activity timelines across systems and document findings with evidence, not just conclusions</li> <li>Monitor the EDR console, investigate suspicious endpoints, and execute containment (host isolation, quarantine) with a senior engineer</li> <li>Triage phishing reports, analyze URLs and attachments in sandbox and threat-intel tools, maintain email and web filtering policies, and run phishing simulations</li> <li>Escalate fast and clearly when a finding exceeds what you can close on your own, and work incidents through incident.io</li> </ul> <h2>What we look for</h2> <ul> <li>1–2 years in security, IT, software engineering or a related technical role. Internships, CTFs, bug bounties, open-source contributions and serious personal projects all count.</li> <li>Working knowledge of at least one of AWS or GCP: you know what IAM, security groups/VPC firewall rules, and a service account are, and you want to go much deeper</li> <li>Comfort in the command line (bash), reading JSON and logs, and reading code in at least one common language (Python, JavaScript, Go) well enough to spot an obvious security issue</li> <li>Basic familiarity with a log query language (SPL, KQL or similar), or the drive to become fluent quickly</li> <li>Conceptual understanding of identity and authentication: OAuth, SSO, MFA, service-to-service auth</li> <li>Hands-on experience using generative AI tools in a technical context, and a healthy skepticism about their output</li> <li>A verify-before-you-conclude instinct: you never take a tool's, a vendor's or an AI agent's answer at face value without evidence</li> <li>Strong written communication in Spanish and English. Much of this job is explaining findings clearly to people who aren't security engineers.</li> <li>Comfort with ambiguity and pace: priorities change, the stack evolves, and you'd rather learn on the job than wait for a course</li> </ul> <h2>Nice to have</h2> <ul> <li>Prior exposure to a SIEM, EDR console (CrowdStrike, SentinelOne, Defender) or email/web security platform</li> <li>Python or JavaScript for scripting and automation</li> <li>Any experience with SAST/dependency scanning tooling, secrets management or CI/CD security</li> <li>Experience prompting or building with LLM APIs, agents or MCP tooling</li> <li>Entry-level certifications (Sec