Senior Security Engineer, Cloud & DevSecOps

Summary

Join Capital Markets Gateway (CMG), a financial technology firm, as a Senior Security Engineer focused on Cloud & DevSecOps. Based in Latin America, you will be responsible for designing, implementing, and evolving cloud security architecture strategies across multi-cloud platforms. You will integrate security best practices into the SDLC, focusing on secure coding and vulnerability scanning. This hands-on role requires collaboration with various teams to identify risks and improve security processes. You will also automate security testing and support compliance initiatives. The ideal candidate possesses extensive experience in cloud and application security, along with expertise in automation tools and containerized environments. CMG offers a competitive compensation package including a 2+ year contract, flexible working hours, and professional development opportunities.

Requirements

• Must be based in LATAM
• English level - C1 or C2
• 7+ years of hands-on experience in information security, with a strong focus on cloud and application security
• 4+ years of experience securing cloud platforms (Azure preferred, AWS, GCP), including deep expertise with cloud-native security tools and Infrastructure as Code (Terraform)
• Proven track record securing application environments and integrating security into DevOps practices
• Strong understanding of API security, encryption, and secrets management in distributed cloud environments
• Hands-on experience with automation tools like Terraform and Ansible, and security-focused CI/CD pipelines
• Expertise in securing containerized environments (Docker, Kubernetes) and addressing vulnerabilities in container images and dependencies
• Strong knowledge of cryptography, key management, and data protection best practices

Responsibilities

• Design, implement, and evolve cloud security architecture strategies and frameworks across multi-cloud platforms (i.e., Azure and either AWS/GCP)
• Conduct risk assessments and secure cloud environments using Infrastructure as Code (IaC) tools like Terraform, ensuring compliance with security standards and policies
• Partner with DevOps on cloud security initiatives, including network security, data protection, secure configurations, and encryption
• Ensure cloud-native services are secured, such as identity management, storage, and compute resources, while ensuring adherence to regulatory and industry standards
• Integrate security best practices into the Software Development Life Cycle (SDLC), focusing on secure coding, dependency management, and continuous vulnerability scanning for languages such as .NET, JavaScript, and Python
• Collaborate with development teams to establish security standards and enforce secure coding practices
• Implement and maintain API security standards, including authentication, encryption, and secrets management
• Ensure containerized applications are secured deployed via Kubernetes, managing both image security and runtime security risks
• Perform threat modeling and risk assessments for both new and existing applications
• Implement and maintain any required security audit trails and/or integrations into security monitoring apparatus
• Develop policy-as-code frameworks and automate security testing in CI/CD pipelines using tools like GitHub Actions, ensuring security is continuously enforced during deployments
• Monitor, assess, and mitigate vulnerabilities in cloud infrastructure, application environments, and containers through regular scans and risk assessments
• Drive the adoption of security automation tools to streamline secure deployments, enforce security policies, and manage cloud configurations
• Support security compliance initiatives, including SOC2, ensuring cloud infrastructure and applications meet regulatory standards
• Mentor engineers and cross-functional teams, advocating for security best practices across cloud, infrastructure, and applications
• Serve as the subject matter expert in security architecture areas such as identity management, encryption, data loss prevention (DLP), and cloud service security
• Develop and maintain security documentation, policies, and procedures for cloud, application, and DevOps environments
• Stay informed on emerging threats and security technologies, driving continuous improvement and innovation in cloud and application security

Preferred Qualifications

• Strong ownership and initiative, with the ability to work independently in a fast-paced environment
• Excellent multitasking and prioritization skills, capable of handling complex, concurrent tasks
• Passion for security innovation, staying ahead of emerging threats, and continuously improving security processes
• Detail-oriented, ensuring thorough tracking of issues and resolutions

Benefits

• 2 year+ contract
• 15 days of vacation
• Tech courses and conferences
• Top-of-the-line MacBook
• Flexible working hours