Security Engineer, Lead

Stack

Responsibilities

• ▹Drive the application security roadmap: threat modelling standards, secure code review practices, API security testing strategy, and security pipeline architecture
• ▹Define the company's approach to securing AI/agentic workflows, setting guardrails for prompts, destructive actions, and data exposure, advising teams building with LLMs/MCP servers
• ▹Set the technical direction for detection engineering, alert pipelines, and automated response across the security stack (Datadog SIEM, CrowdStrike, Cloudflare)
• ▹Own incident response readiness at a program level: design IR playbooks, lead tabletop exercises, act as technical lead during major incidents
• ▹Set the standard and approach for cloud security assessments across AWS and Kubernetes
• ▹Own the vendor security assessment framework, handling the highest-risk vendor reviews
• ▹Act as a technical mentor to mid and senior engineers, reviewing detection logic, assessments, and playbooks

Requirements

• ▹7+ years in information security, including experience building or substantially maturing a security function or program from the ground up
• ▹2+ years at a regulated fintech/bank/payment company
• ▹Deep, hands-on expertise in cloud infrastructure security (AWS, Kubernetes)
• ▹Proven experience driving application security programs: threat modelling, secure code review standards, CI/CD pipeline hardening, API security testing
• ▹Demonstrated ability to define practical security guardrails for AI/agentic tooling, understanding risks of LLM integrations and MCP servers
• ▹Strong detection engineering background, experience mentoring others in writing rules
• ▹Deep experience with endpoint security tooling (EDR/XDR) and identity & access management in a SaaS-heavy environment (Google Workspace, Okta/Cloudflare Access, SSO/SCIM)
• ▹Experience designing or significantly evolving a vendor security assessment/third-party due diligence program
• ▹Excellent written and verbal communication
• ▹Business fluent in English

Soft skills

What we offer

• ▹Competitive salary and benefits
• ▹Stock options
• ▹Discretionary performance bonus
• ▹The latest tools and technology
• ▹A world-class team that will challenge and grow your skills
• ▹Opportunity to help build a leading fintech app in Latin America

About the company

ARQ is a fintech company building its first Security Engineer function in Brazil, working closely with a global security team; office policy is 3-4 days a week in-office.