About dLocal
dLocal enables the biggest companies in the world to collect payments in 40 countries in emerging markets. Global brands rely on us to increase conversion rates and simplify payment expansion effortlessly. As both a payments processor and a merchant of record where we operate, we make it possible for our merchants to make inroads into the world's fastest-growing, emerging markets.
Responsibilities
•Design and optimize SOAR workflows to eliminate manual toil. If a process is repeatable, you automate it. We keep the team small and senior on purpose: automation and AI do the volume work, people do the judgment.
•Partner with the Cyber Detection & Response (CDR) team to architect, deploy, and maintain the health of our core defensive stack (SIEM, EDR, DLP, CASB, CSPM, DSPM). You ensure the platforms are built to provide the high-fidelity signals needed to defend the business.
•Partner with Cloud & Platform Security (CPS) to design secure-by-default AWS architectures, golden AMIs, and hardened Kubernetes (EKS) base images that serve as the blueprint for engineering teams. You will enforce technical guardrails through native AWS resources, advanced CNAPP platform modules, and Preemptive Cloud Security solutions, translating CPS policy requirements into engineering reality and empowering teams with automated tools to build securely without bottlenecks.
•Identify, onboard, and validate log sources across production and enterprise. You own the full log lifecycle: from ingestion and observability pipelines to detection and automated response workflows.
•Work with the internal security teams to feed platform signals into automated, AI-assisted response pipelines.
•Configure agent policies and manage the underlying infrastructure, including patching and scaling. You make the final call on security-vs-productivity trade-offs, ensuring the fleet is baseline-secure and performant.
Requirements
•6+ years of hands-on experience across Security Operations, Detection Engineering, and Cloud Security. What counts is what you built and owned in those years, not what you operated.
•A proven track record of building and owning defensive infrastructure and cloud security at scale.
•You see the 10,000-foot strategic goal and relentlessly drive the technical execution to get us there. The CISO and Head of Enterprise Cyber set the direction; the how is yours, and so is its quality.
•You understand the vision deeply before you build. If you think we are wrong, say it openly and bring the evidence. Convince us and we change course. What you never do is agree in the room and build something else.
•Absolute technical mastery over modern defensive tooling (SIEM, EDR, DLP, CSPM, CNAPP, DSPM) at the configuration and architecture level, not the dashboard level.
•Same for cloud-native engineering: advanced AWS security architecture (IAM, SCPs, GuardDuty, and beyond), production EKS hardening, and Kubernetes security from first principles.
•You build integrations and automate workflows because doing things manually at scale offends you.
•You are deeply comfortable using LLMs and AI agents to automate repetitive tasks & workflows, assist response pipelines, and move at 10x speed, while maintaining strict data accuracy.
•You build and maintain detections that find real attacker behavior, while also automating the response workflows.
•Exceptional cross-functional range: you can run a threat modeling session with a product team, hand off a prioritized backlog to DevOps, and work Offensive Security findings through to fixes, all while bringing people along and negotiating pragmatic trade-offs without alienating stakeholders.
•Stakeholder intelligence is a real skill you have built. You understand that security cannot kill velocity — every trade-off you make keeps the business moving and the environment secure.
•High autonomy means high accountability. You are ruthlessly organized, comfortable with ambiguity, and do not wait for someone to define the path.
•You have the humility to do the manual work when it needs doing while building the automation to replace it.
Conditions
Details regarding comprehensive benefits and compensation packages will be discussed directly during the hiring process.
