Senior Security Engineer

📋 Job Overview

Security has been part of how Nelo builds software from day one. As we scale, we are creating a dedicated Security Engineer role with broad ownership across application security, cloud infrastructure, and internal controls. This is a hands-on role for someone who wants to define the security function rather than inherit it. You will decide where to invest, implement controls yourself, and balance risk against velocity in a fast-moving lending business. You will work directly with the CTO, the CEO, and engineering leadership. This role is in-person at our Mexico City office in Condesa.

🏢 About Nelo

Nelo is a leading fintech in Mexico reimagining credit to expand consumer buying power. Founded in 2019 by former Uber international growth team leads Kyle Miller and Stephen Hebson, Nelo offers credit cards, BNPL loans, bill payments, and its own marketplace — all under one app — designed from first principles for a mobile-first, real-time payments world. With $100M in annual revenue, $1B in annualized GMV, and $140M+ raised in equity and debt, Nelo is one of the most capital-efficient consumer fintech companies in Latin America. The company is profitable — positive operating profit in both 2024 and 2025. It runs lean and technical: 60 employees, 8 engineers, with AI driving underwriting, collections, and operations. HQ: Mexico City, Mexico; commercial and people operations in New York City. Founded: 2019. Team size: 60 FTEs. Open roles: 10+. Website: nelo.mx. Stage: Post-Series A; $100M credit facility (Victory Park Capital, 2022); profitable. Benefits: 401k, open PTO, medical, dental, vision, STD, LTD, fertility. Company values: Be your best selves: ambition, hard work, intellectual curiosity. Everyone is an owner: all employees receive equity including customer support; 10-year option expiration; equity refreshers. Customer first: product decisions grounded in customer benefit. Open and honest communication: quarterly financials and board presentations shared company-wide; low tolerance for bureaucracy or gossip. Move fast, learn fast: hundreds of experiments run monthly; rigorous experimentation culture.

🎯 The Role

This is a hands-on role for someone who wants to define the security function rather than inherit it. You will decide where to invest, implement controls yourself, and balance risk against velocity in a fast-moving lending business. You will work directly with the CTO, the CEO, and engineering leadership. This role is in-person at our Mexico City office in Condesa.

✅ Key Responsibilities

• Build secure-by-default systems
• Design and implement security guardrails across cloud infrastructure and developer workflows
• Improve IAM, secrets management, endpoint management, and access controls across production systems
• Harden AWS infrastructure using Terraform and policy-as-code
• Increase observability for security-relevant events and anomalies
• Treat security as an engineering problem
• Write code, configs, and tooling to enforce controls
• Replace manual reviews with automation wherever it makes sense
• Make the secure path the default path for engineers
• Run external security programs
• Own penetration tests and the bug bounty program end-to-end
• Triage findings, partner with engineers on fixes, and turn one-off issues into systemic improvements
• Drive certifications and compliance
• Take Nelo through SOC 2 Type 1 and Type 2
• Build automated evidence collection so compliance does not become a recurring tax on the team
• Raise the bar across engineering
• Set the standard through your own implementations
• Review designs and PRs with a security-first lens

📌 Required Qualifications

• Engineering background with substantial time spent on security in production environments
• Strong hands-on experience with AWS security services and infrastructure
• Experience building security programs from the ground up in a startup environment
• Deep understanding of application security principles and practices
• Experience with security automation and tooling
• Knowledge of compliance frameworks such as SOC 2
• Ability to balance security requirements with business velocity

⭐ Desirable Experience

• Experience with Terraform and infrastructure as code
• Experience with Python, Go, or similar programming languages
• Experience with AI tools in security workflows
• Experience with penetration testing and bug bounty programs
• Experience with observability and security monitoring tools

🎁 Benefits

401k, open PTO, medical, dental, vision, STD, LTD, fertility

🛂 Visa & Eligibility

No visa sponsorship available. Candidates must be authorized to work in Mexico.