Cloud Security Engineer (LatAm Only) at R2

Job description

At R2, we believe that small and medium businesses are the productive engine of society. Small and medium businesses (SMBs) make up over 90% of companies in Latin America, yet they face a trillion-dollar credit gap. Our mission is to unlock SMBs’ potential by providing financial solutions tailored to their needs. We are reimagining the financial infrastructure of Latin America, where SMBs’ financial needs are met without ever having to go to a bank. R2 enables platforms across Latin America to embed financial services that SMBs can leverage, starting with revenue-based financing. We are a high-performing, close-knit team with talent from organizations such as Google, Amazon, Nubank, Uber, Capital One, Mercado Libre, Globant, and J.P. Morgan. We are entering a new phase of growth following a strategic investment from Ant International, focused on rapidly expanding our partner footprint, strengthening our credit and underwriting capabilities, and scaling operations across multiple markets. As part of this growth journey, eligible team members have the opportunity to participate in R2’s Phantom Share Program, a performance-based incentive designed to align our team with the company’s long-term success and value creation. We believe in building a culture of ownership, where those who help create value share meaningfully in it. R2 is scaling quickly, and we're looking for a Cloud Security Engineer (IC3). You will secure R2’s cloud infrastructure and drive the adoption of DevSecOps practices across engineering. You’ll report to the Director of Infrastructure and work closely with our Security, Infrastructure and Platform Engineering teams. We’re looking for someone proactive, detail-oriented, and passionate about technology. What You'll Do Cloud Security Posture Operate and improve CSPM, CNAPP and DSPM tooling across R2’s AWS footprint Identify, prioritize, triage and track remediation of cloud security findings end-to-end Ensure zero open high-severity findings older than 30 days IAM, Secrets & Data Protection Implement and harden IAM controls, encryption, secrets management and data protection across AWS accounts Own secrets rotation and access review processes for production systems DevSecOps & Automation Integrate security controls into CI/CD pipelines (GitHub Actions, GitLab CI) — SAST/SCA/IaC scanning with blocking criteria for high-severity findings Automate security processes via scripting (Python/Bash/Go), APIs and Terraform/IaC Network & Perimeter Security Manage and harden network security controls — WAF rule sets, security groups, NACLs, and network segmentation across VPCs Tune and maintain AWS WAF rate-limiting thresholds and manage rule groups against scanning and malicious traffic Enforce least-privilege network access across accounts and environments GenAI & Agent Security Contribute to securing R2’s GenAI applications, RAG architectures, agents, APIs, connectors and MCP servers Design and build internal AI/LLM-based security agents to automate threat detection, finding triage, and incident response. Define controls against data leakage, improper access, prompt injection and unsafe tool use by autonomous agents SOC & Detection Collaborate with the SOC on alert integration and use-case development in SIEM Cross-functional Build and maintain security documentation, runbooks and standards Support incident response, root cause analysis and remediation across production environments Who You Are 3–5 years of experience in cloud security, DevSecOps or a similar role Hands-on experience with CSPM/CNAPP/DSPM platforms (Wiz, Prisma Cloud, Orca or equivalent) Strong AWS security knowledge (IAM, KMS, Secrets Manager, Security Hub, GuardDuty, Inspector) Experience embedding security into CI/CD pipelines and Infrastructure as Code (Terraform) Scripting ability (Python, Bash; Go a plus) for security automation via APIs Familiarity with Kubernetes/EKS and container security Experience hardening network security controls (WAF, security groups, NACLs, VPC segmentation) Understanding of GenAI/LLM security risks (prompt injection, agentic tool misuse, data leakage) English proficiency — written and spoken (required) Nice to Have AWS Certified Security – Specialty Experience with SIEM/SOAR platforms Familiarity with ISO 27001, SOC 2, or similar compliance frameworks Fintech or regulated-industry experience What We Offer The chance to join a high-impact, mission-driven fintech. Ownership and impact in a fast-paced, growth-oriented startup. Cross-functional collaboration with exceptional teams. Exposure to complex regulatory challenges and innovation in embedded finance. Locations: Buenos Aires, São Paulo, Bogotá, Santiago

Requirements

Must-haves

Cloud Security Posture
Operate and improve CSPM, CNAPP and DSPM tooling across R2’s AWS footprint
Identify, prioritize, triage and track remediation of cloud security findings end-to-end
Ensure zero open high-severity findings older than 30 days
IAM, Secrets & Data Protection
Implement and harden IAM controls, encryption, secrets management and data protection across AWS accounts
Own secrets rotation and access review processes for production systems
DevSecOps & Automation
Integrate security controls into CI/CD pipelines (GitHub Actions, GitLab CI) — SAST/SCA/IaC scanning with blocking criteria for high-severity findings
Automate security processes via scripting (Python/Bash/Go), APIs and Terraform/IaC
Network & Perimeter Security
Manage and harden network security controls — WAF rule sets, security groups, NACLs, and network segmentation across VPCs
Tune and maintain AWS WAF rate-limiting thresholds and manage rule groups against scanning and malicious traffic
Enforce least-privilege network access across accounts and environments
GenAI & Agent Security
Contribute to securing R2’s GenAI applications, RAG architectures, agents, APIs, connectors and MCP servers
Design and build internal AI/LLM-based security agents to automate threat detection, finding triage, and incident response.
Define controls against data leakage, improper access, prompt injection and unsafe tool use by autonomous agents
SOC & Detection

Nice-to-haves

Scripting ability (Python, Bash; Go a plus) for security automation via APIs
AWS Certified Security – Specialty
Experience with SIEM/SOAR platforms
Familiarity with ISO 27001, SOC 2, or similar compliance frameworks
Fintech or regulated-industry experience

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

goawsci/cdpythonaillmkubernetes

Platform: bamboohr
Effort: medium