Senior Security Engineer, dLocal

• A "Builder" Mindset: 4-8+ years of hands-on experience in Cloud Security, Platform Security, or DevSecOps. You have a passion for building preventative solutions from the ground up
• Deep Cloud-Native Expertise: Advanced AWS security architecture (multi-account, IAM boundaries, org SCPs) and expert-level, hands-on knowledge of building and securing production environments
• Mastery of Modern Stacks: Deep, practical experience with production EKS baseline hardening (admission control, least privilege, runtime controls). You are fluent in IaC (Terraform, Pulumi, or Ansible) and have strong scripting/automation skills (Python, Go, etc.)
• Application & Edge Security: Hands-on experience configuring and tuning modern WAFs, CDNs, and edge security platforms (e.g., Cloudflare, Akamai, AWS WAF)
• A Pragmatic Risk-Based Approach: You can translate risks from threat models and compliance frameworks (CIS, NIST, OWASP, PCI) into actionable, prioritized engineering work—not just checkbox-ticking
• A Force-Multiplier: You have a leadership attitude to influence and mentor engineers, document complex systems clearly, and influence other teams to adopt security-first practices

Desirable

• We are looking for a hands-on builder and executor who lives and breathes "secure-by-default" infrastructure. This isn't just a compliance or audit role; it's a "full-stack" security engineering position focused on prevention. You'll be an architect, an engineer, and a key enabler, codifying security into every part of our cloud and CI/CD lifecycle
• In our environment, a small, senior team means massive impact
• You won't just write policies—you'll codify them as automated guardrails, design the hardened platforms our services run on, and build the "paved road" that makes security the easiest and fastest path for all our engineers
• You’ll partner closely with dLocal’s Cloud Platform/SRE teams to deliver shared guardrails and ‘paved road’ services, not day-to-day platform operations
• This role is focused on prevention and platform engineering
• Engineer Secure-by-Default Foundations: Design, build, and maintain hardened, multi-account AWS architectures, "golden" AMIs, and secure-by-default container/Kubernetes (EKS) base images
• Automate Security via IaC: Be the expert in "Policy-as-Code." Publish and maintain Infrastructure controls, golden Terraform modules, Helm charts, and admission policies
• You will measure adoption, drift detection, and exception aging while preventing misconfigurations before they're deployed
• Own the Platform & Edge Defense: Configure and manage runtime security for Kubernetes (e.g. , admission controllers, least-privilege policies) and own the safe-change processes for our layered edge defenses (WAF/CDN/anti-Bot), including pre-prod testing, blast-radius limits, rollback patterns, and change metrics
• Generate High-Fidelity Signals: Integrate posture signals (CSPM, KSPM, CI/CD, WAF) into centralized dashboards and our SIEM/SOAR with clear routing and ownership, partnering with D&R to ensure signals are high-fidelity and actionable
• Enable & Mentor: Lead threat modeling exercises and partner with Platform, SRE, and Product teams to translate risks into actionable backlogs
• You'll be mentoring others on prevention-first design
• Support Incident Response: Define platform incident playbooks for misconfiguration and drift containment
• You will act as the senior subject-matter expert for cloud/platform incidents, providing deep technical expertise to the IR team
• You will work through Cloud Platform/SRE teams to roll out guardrails as shared services and "paved roads."
• You'll coordinate with the Application Security team for threat modeling and with the Detection & Response (D&R) team for signal fidelity and automated containment handoffs

• Our Talent Acquisition team is invested in creating the best candidate experience possible, so don’t worry, you will definitely hear from us. We will review your CV and keep you posted by email at every step of the process!