Senior Security Engineer

Senior Security Engineer LocationCDMXEmployment TypeFull timeLocation TypeOn-siteDepartmentEngineeringSecurity EngineerAbout NeloNelo is a leading fintech in Mexico reimagining credit to expand consumer buying power. Founded in 2019 by former Uber international growth team leads Kyle Miller and Stephen Hebson, Nelo offers credit cards, BNPL loans, bill payments, and its own marketplace — all under one app — designed from first principles for a mobile-first, real-time payments world.With $100M in annual revenue, $1B in annualized GMV, and $140M+ raised in equity and debt, Nelo is one of the most capital-efficient consumer fintech companies in Latin America. The company is profitable — positive operating profit in both 2024 and 2025. It runs lean and technical: 60 employees, 8 engineers, with AI driving underwriting, collections, and operations.HQ: Mexico City, Mexico; commercial and people operations in New York CityFounded: 2019Team size: 60 FTEsOpen roles: 10+Website: nelo.mxStage: Post-Series A; $100M credit facility (Victory Park Capital, 2022); profitableBenefits: 401k, open PTO, medical, dental, vision, STD, LTD, fertilityCompany values:Be your best selves: ambition, hard work, intellectual curiosityEveryone is an owner: all employees receive equity including customer support; 10-year option expiration; equity refreshersCustomer first: product decisions grounded in customer benefitOpen and honest communication: quarterly financials and board presentations shared company-wide; low tolerance for bureaucracy or gossipMove fast, learn fast: hundreds of experiments run monthly; rigorous experimentation cultureAbout the roleSecurity has been part of how Nelo builds software from day one. As we scale, we are creating a dedicated Security Engineer role with broad ownership across application security, cloud infrastructure, and internal controls.This is a hands-on role for someone who wants to define the security function rather than inherit it. You will decide where to invest, implement controls yourself, and balance risk against velocity in a fast-moving lending business. You will work directly with the CTO, the CEO, and engineering leadership.This role is in-person at our Mexico City office in Condesa.What you'll doBuild secure-by-default systemsDesign and implement security guardrails across cloud infrastructure and developer workflowsImprove IAM, secrets management, endpoint management, and access controls across production systemsHarden AWS infrastructure using Terraform and policy-as-codeIncrease observability for security-relevant events and anomaliesTreat security as an engineering problemWrite code, configs, and tooling to enforce controlsReplace manual reviews with automation wherever it makes senseMake the secure path the default path for engineersRun external security programsOwn penetration tests and the bug bounty program end-to-endTriage findings, partner with engineers on fixes, and turn one-off issues into systemic improvementsDrive certifications and complianceTake Nelo through SOC 2 Type 1 and Type 2Build automated evidence collection so compliance does not become a recurring tax on the teamRaise the bar across engineeringSet the standard through your own implementationsReview designs and PRs with a security-first lensWhy you should applyYou have built security programs at a startup before and know the difference between security theater and controls that actually reduce risk. You can tell which one a given investment is.You write code and ship infrastructure yourself. Terraform, Python, Go, whatever the job calls for. You do not hand off implementation to someone else and call it done.You have deep AWS instincts. You know where the sharp edges are in IAM, how to read CloudTrail, when GuardDuty findings matter and when they are noise.You have taken a company through SOC 2 or a comparable certification and you know how to run it without grinding engineering to a halt. Automated evidence collection is the...