Security Engineer (Ingeniero/a de Seguridad)

<div class="content-intro"><p><strong>Clara is the leading platform in Latin America for companies to execute and manage every payment operation.</strong> More than 50,000 leading and fast-growing businesses run on our corporate cards, bill pay, financing and B2B payments, and in 2025 the Financial Times named Clara the region’s fastest-growing company. We’re passionate about helping every company we work with become more effective—and, through that, raising the region’s competitiveness. We’re ~400 people, backed by Notable Capital, Coatue, Kaszek, monashees, DST Global, ICONIQ, General Catalyst and Goldman Sachs, among others.</p></div><h1>Security Engineer</h1> <h2>What you'll do</h2> <p>You will own outcomes, not a queue. You'll lead workstreams across the security function, pair with and mentor early-career engineers, and be trusted to make calls without waiting for sign-off.</p> <p><strong>Own the AI security posture, enabling rather than blocking</strong></p> <ul> <li>Define and operate the controls for how Clara uses LLMs, coding agents, agentic browsers, MCP integrations and internal inference gateways: data handling, identity, permissions, logging</li> <li>Own the LLM-based investigation agent on the SIEM: design its instructions and rules, evaluate its accuracy, catch hallucinated attributions and unsupported conclusions, and decide what it is allowed to close autonomously</li> <li>Threat-model AI systems as first-class attack surface: prompt injection, data exfiltration through AI tools, over-privileged agents, model and tool supply chain</li> <li>Build the guidance and paved paths that let product and engineering adopt AI safely by default, and be a credible voice in those decisions</li> </ul> <p><strong>Cloud security on AWS and GCP</strong></p> <ul> <li>Own detection and posture across AWS (GuardDuty, IAM, VPC, CloudTrail) and GCP (Security Command Center, IAM, service accounts, org policies), and drive remediation with the owning teams</li> <li>Design and implement guardrails as code: organization policies, SCPs, IAM boundaries, infrastructure-as-code policy checks</li> <li>Lead parts of our large-scale GCP project inventory and cleanup program, and turn one-off findings into automated controls</li> <li>Secure identity and edge: Auth0, Cloudflare, Google Workspace, SSO and service-to-service authentication</li> </ul> <p><strong>Secure code, CI/CD and application security</strong></p> <ul> <li>Run and evolve the application security program: SAST (SonarQube, Semgrep or similar), dependency and secrets scanning, PR review for security-sensitive changes, and CI/CD pipeline hardening</li> <li>Review architecture and code for new products and integrations (card issuing, payments, banking partners) and produce actionable, prioritized findings</li> <li>Define secure-by-default patterns and libraries for engineers, including for AI-generated code, and measure whether they're being used</li> <li>Coordinate pentests and vulnerability disclosure, and drive findings to closure</li> </ul> <p><strong>Detection, response and incident leadership</strong></p> <ul> <li>Build and tune detections in Splunk across identity/SSO, cloud, endpoint, email and network sources, with a bias toward high-signal alerts</li> <li>Lead incident investigation and response through incident.io: scoping, containment (EDR isolation, credential revocation, cloud access), root cause and post-incident review</li> <li>Own email and web protection policy and the phishing program</li> <li>Mentor early-career engineers on investigation technique and evidence-based reporting, and review their work</li> </ul> <p><strong>Compliance as a byproduct of good engineering</strong></p> <ul> <li>Map your controls to PCI DSS and ISO 27001 requirements, and produce the evidence auditors need without slowing the team down</li> <li>Support customer security reviews and enterprise sales when a technical voice is needed</li> </ul> <h2>What we look for</h2> <ul> <li>2–4 years in security engineering, cloud security, application security or a closely related engineering role, including hands-on production experience</li> <li>Strong, practical knowledge of AWS and/or GCP security: IAM design, network controls, logging and detection, and the ability to read and write infrastructure as code (Terraform or similar)</li> <li>Solid programming ability in at least one language (Python, Go, JavaScript/TypeScript): you build tooling and automation, not just review other people's code</li> <li>Real secure-code experience: you can find and explain injection, auth/authz, secrets handling and supply-chain issues in code and in CI/CD pipelines, and you know how to get developers to fix them</li> <li>Hands-on experience with a SIEM (Splunk preferred) and an EDR platform, including detection engineering and investigation</li> <li>Working understanding of LLM-based systems and agents, including their failure modes, and experience using or building with them in a technical setting</li> <li>Sound judgment on risk: you know the difference between a finding that blocks a launch and one that ships with a follow-up, and you can defend that call</li> <li>Strong written and spoken communication in Spanish and English; you can explain a risk to an engineer, a product manager and an auditor in the same week</li> <li>Comfort with pace and ambiguity: priorities move, the stack evolves, and