Security Engineer (Early Career) (Ingeniero/a de Seguridad - Carrera Temprana) - Mexico City (Remote)

<div class="content-intro"><p><strong>Clara is the leading platform in Latin America for companies to execute and manage every payment operation.</strong> More than 50,000 leading and fast-growing businesses run on our corporate cards, bill pay, financing and B2B payments, and in 2025 the Financial Times named Clara the region’s fastest-growing company. We’re passionate about helping every company we work with become more effective—and, through that, raising the region’s competitiveness. We’re ~400 people, backed by Notable Capital, Coatue, Kaszek, monashees, DST Global, ICONIQ, General Catalyst and Goldman Sachs, among others.</p></div><h1>Security Engineer (Early Career)</h1> <h2>What you'll do</h2> <p>You will rotate across the security function in your first year, with real ownership from the first month. Expect the mix below to shift as the business does.</p> <p><strong>Secure the AI posture, without blocking it</strong></p> <ul> <li>Review how teams use LLMs, coding agents and AI tooling (Claude, agentic browsers, internal inference gateways) and help define guardrails that protect data without killing adoption</li> <li>Operate our LLM-based investigation agent on the SIEM: catch hallucinated attributions, noisy alerts and conclusions the underlying data doesn't support, and tune its instructions before they reach production</li> <li>Develop the core skill of this role: knowing when to trust an AI-generated result and when to verify it by hand</li> <li>Help build our view of prompt injection, data exfiltration through AI tools, and model/agent permissions as first-class risks</li> </ul> <p><strong>Cloud security on AWS and GCP</strong></p> <ul> <li>Triage findings from AWS GuardDuty, GCP Security Command Center, IAM and network configuration reviews</li> <li>Run configuration and posture checks, and drive fixes with the owning teams instead of just filing tickets</li> <li>Contribute to our large-scale GCP project inventory and cleanup, and keep the central findings tracker honest</li> <li>Learn Auth0, Cloudflare and Google Workspace security controls as they apply to identity, edge and SaaS</li> </ul> <p><strong>Secure code and CI/CD</strong></p> <ul> <li>Review internal tools, scripts and pull requests for the classics: hardcoded credentials, unsafe input handling, over-broad permissions, secrets in pipelines</li> <li>Own SonarQube and dependency-scanning results for internal repositories: prioritize CVEs, follow up with developers, close the loop</li> <li>Review CI/CD changes that touch security-sensitive configuration (secrets, deployment access, IAM bindings)</li> <li>Help push secure-by-default patterns into how engineers actually work, including the code they generate with AI</li> </ul> <p><strong>Detection, response and triage</strong></p> <ul> <li>Write and refine Splunk queries to investigate alerts from identity/SSO, cloud, endpoint, email and network sources</li> <li>Maintain detection rules and dashboards; hunt down false positives and false negatives</li> <li>Reconstruct user activity timelines across systems and document findings with evidence, not just conclusions</li> <li>Monitor the EDR console, investigate suspicious endpoints, and execute containment (host isolation, quarantine) with a senior engineer</li> <li>Triage phishing reports, analyze URLs and attachments in sandbox and threat-intel tools, maintain email and web filtering policies, and run phishing simulations</li> <li>Escalate fast and clearly when a finding exceeds what you can close on your own, and work incidents through incident.io</li> </ul> <h2>What we look for</h2> <ul> <li>1–2 years in security, IT, software engineering or a related technical role. Internships, CTFs, bug bounties, open-source contributions and serious personal projects all count.</li> <li>Working knowledge of at least one of AWS or GCP: you know what IAM, security groups/VPC firewall rules, and a service account are, and you want to go much deeper</li> <li>Comfort in the command line (bash), reading JSON and logs, and reading code in at least one common language (Python, JavaScript, Go) well enough to spot an obvious security issue</li> <li>Basic familiarity with a log query language (SPL, KQL or similar), or the drive to become fluent quickly</li> <li>Conceptual understanding of identity and authentication: OAuth, SSO, MFA, service-to-service auth</li> <li>Hands-on experience using generative AI tools in a technical context, and a healthy skepticism about their output</li> <li>A verify-before-you-conclude instinct: you never take a tool's, a vendor's or an AI agent's answer at face value without evidence</li> <li>Strong written communication in Spanish and English. Much of this job is explaining findings clearly to people who aren't security engineers.</li> <li>Comfort with ambiguity and pace: priorities change, the stack evolves, and you'd rather learn on the job than wait for a course</li> </ul> <h2>Nice to have</h2> <ul> <li>Prior exposure to a SIEM, EDR console (CrowdStrike, SentinelOne, Defender) or email/web security platform</li> <li>Python or JavaScript for scripting and automation</li> <li>Any experience with SAST/dependency scanning tooling, secrets management or CI/CD security</li> <li>Experience prompting or building with LLM APIs, agents or MCP tooling</li> <li>Entry-level certifications (Security+, AWS Cloud Practitioner, Google Cloud Digital Leader / Associate Cloud Engineer, or similar)</li> <li>Portuguese</li> </ul> <h2>What you'll get</h2> <ul> <li>Exposure to the full security surface of a regulated fintech in your first year: cloud, code, detection, response, compliance and AI, rather than a single queue</li> <li>A senior team that pairs with you on investigations and reviews, and expects you to push back when the evidence doesn't hold</li> <li>Direct work on problems most security teams haven't solved yet: securing agentic AI in production</li> <li>A modern stack: AWS, GCP, Splunk, Auth0, Cloudflare, SonarQube, incident.io, Claude and internal AI tooling</li> <li>Budget and time for certifications, conferences and the hacker community</li> <li>Fast, transparent hiring: application review, a technical conversation about real scenarios (no gotcha puzzles), a practical exercise you can do in a few hours, and a conversation with the team</li> </ul> <h2>How to stand out</h2> <p>Send us something you've built, broken or written: a repo, a CTF write-up, a bug report, a blog post, a detection rule. We care far more about how you think and how you learn than about the exact list of tools on your CV.</p> <p><strong>Where we work</strong></p> <p>This is a remote-first role: you'll work from home day to day. You'll ramp up in person with the team, and come together in person for team moments, events and customer visits through the year.</p><div class="content-conclusion"><h2>Why Clara</h2> <ul> <li><strong>A high talent-density team</strong> driven to make an impact in Latin America — low ego, high ownership.</li> <li>Competitive salary and stock options (ESOP) from day one.</li> <li>An annual learning budget and accelerated development paths.</li> <li>English is our working language, with Spanish and Portuguese every day.</li> </ul> <h2>How we work</h2> <ul> <li><strong>Clarity</strong> — Open and direct communication: we say what we mean and give context where it matters.</li> <li><strong>Simplicity</strong> — If it can be simpler, it should be.</li> <li><strong>Ownership</strong> — We own everything we do, end to end. When something needs to happen, we don't wait.</li> <li><strong>Pride</strong> — We hold ourselves to a high standard, and it shows in what we deliver.</li> <li><strong>ABC (Always Be Changing)</strong> — We adapt fast, embrace change, and keep learning.</li> <li><strong>Inclusivity</strong> — Diverse ideas, stories and perspectives build a better Clara.</li> </ul> <p>If you meet the must-haves, apply — the nice-to-haves are a bonus, not a requirement.</p></div>