Head of security

Accountabilities:

Security Strategy and Leadership: Define and own a risk-based security strategy and roadmap, prioritizing initiatives according to threat exposure, business impact, and operational risk. Communicate security posture, priorities, and investment needs to executive leadership and the board.
Incident Response and Resilience: Lead the detection, investigation, containment, and recovery of security incidents. Maintain incident response playbooks, coordinate with external forensic specialists, legal counsel, and communications teams, and conduct post-incident reviews to drive continuous improvement.
Application Security: Integrate security throughout the software development lifecycle through threat modeling, secure architecture reviews, code reviews, security testing, dependency scanning, and practical secure coding standards.
Cloud and Infrastructure Security: Partner with infrastructure teams to strengthen security across AWS, Kubernetes, networking, and CI/CD pipelines. Oversee identity and access management, least-privilege controls, secrets management, and security practices for Terraform and GitOps workflows.
Threat Detection and Monitoring: Develop and improve security monitoring, logging, alerting, and detection capabilities across applications, infrastructure, and access systems. Optimize detection rules to identify malicious activity early while minimizing false positives.
Cryptographic and Key Management Security: Define and maintain security controls for cryptographic keys, wallets, custody operations, and blockchain integrations supporting payment infrastructure.
Fraud and Account Protection: Collaborate with Product and Risk teams to strengthen defenses against account takeover, fraudulent activity, abuse, and suspicious transactions.
AI Security and Governance: Establish security guardrails for AI-assisted coding tools, AI agents, and LLM-powered systems. Address risks such as prompt injection, unauthorized tool access, excessive agent permissions, and sensitive data exposure.
Compliance and Security Assurance: Lead the security compliance program, including SOC 2 and other relevant frameworks, audit preparation, customer assessments, and security questionnaires. Integrate compliance requirements into everyday engineering practices.
Third-Party and Vendor Risk: Manage vendor security assessments and due diligence for strategic partners, investors, acquirers, and other external stakeholders.
Vulnerability and Patch Management: Establish risk-based remediation timelines and severity-based SLAs, coordinating with engineering teams to address vulnerabilities efficiently without creating unnecessary delivery bottlenecks.
Team Building and Mentorship: Recruit, develop, and lead security professionals while establishing a security champions network across product teams and raising security awareness throughout engineering.
Production Security Escalation: Participate in and help define security escalation procedures for production incidents, ensuring effective coordination, timely decisions, and clear accountability.
Requirements:
At least 8 years of experience in information security or application security, including 3 or more years leading security teams or security functions.
Demonstrated experience managing high-impact security incidents, including coordinating investigations with external forensic specialists and legal counsel.
Strong hands-on knowledge of AWS and Kubernetes security, including IAM, network segmentation, role-based access control (RBAC), secrets management, container security, and image protection.
Proven experience implementing application security in microservices environments, including threat modeling, secure code reviews, dependency management, and software supply-chain risk mitigation.
Experience building and operating security monitoring and detection capabilities, including SIEM solutions, log analysis, alerting, and tools such as Datadog or equivalent platforms.
Experience owning or leading security compliance programs such as SOC 2, ISO 27001, or PCI DSS, including audit preparation and execution.
Ability to read and review TypeScript and Node.js code, as well as infrastructure-as-code configurations using Terraform, and communicate effectively with software engineers.
Practical experience securing CI/CD pipelines and managing software supply-chain risks.
Hands-on experience using AI-assisted development tools such as Claude Code, Cursor, or GitHub Copilot for security-related work, alongside a clear understanding of the risks associated with AI-generated code and agentic systems.
Strong communication and stakeholder management skills, with the ability to explain technical risks and trade-offs to engineers, executives, regulators, and customers.
Excellent judgment under pressure, including the ability to make timely, defensible decisions when information is incomplete.
A collaborative leadership style that encourages secure engineering practices, empowers teams through practical guardrails, and balances risk management with delivery speed.
Strong ownership, adaptability, mentoring skills, and the ability to work effectively across Engineering, Product, Infrastructure, Legal, Compliance, and Support.
Nice to have:
Experience in fintech, payments, remittances, or cryptocurrency, particularly with cryptographic key management, custody operations, and blockchain security.
Experience addressing fraud, account takeover, transaction abuse, and related financial security risks.
Experience securing AI agents and production LLM systems, including prompt injection defenses, tool-permission models, security evaluations, and red-teaming.
Hands-on offensive security experience, including penetration testing, red teaming, or managing bug bounty programs.
Familiarity with cloud-native security tooling, including cloud security posture management (CSPM), runtime protection, and policy-as-code solutions such as OPA or Kyverno.
Knowledge of regulatory requirements for money transmission and financial services across multiple jurisdictions.
Relevant security certifications, such as CISSP, CISM, OSCP, or AWS Certified Security – Specialty.
Experience supporting security due diligence for investors, prospective buyers, or enterprise customers.
Experience establishing and scaling a security function within a fast-growing engineering organization.
Benefits:
Remote work: Fully remote opportunity within Brazil, offering flexibility and the ability to work in a distributed environment.
Strategic ownership: Lead the security strategy for a financial technology platform operating in the cross-border payments ecosystem.
Leadership opportunity: Build and scale a security function, develop a team, and establish security practices across engineering.
Technical innovation: Work with cloud-native infrastructure, Kubernetes, microservices, blockchain integrations, and AI-assisted development technologies.
Cross-functional collaboration: Partner with engineering leaders and teams across Product, Infrastructure, Risk, Legal, Compliance, and Support.
Professional impact: Influence executive-level security decisions and help protect financial transactions, sensitive information, and critical systems.
Continuous development: Shape security practices in emerging areas, including AI agents, LLM security, cloud security, and modern application protection.