Principal Security Engineer, Defensive Infrastructure

dLocal; Madrid; On-site; EUR 90,000 - 130,000; Full time

Job summary

dLocal is seeking a senior security engineering professional to own the detection and defensive infrastructure that protects our cloud-native platform. You will automate, architect and operate security tooling across SIEM, EDR, DLP, CSPM, CNAPP, and DSPM, while enabling secure, scalable AWS and Kubernetes deployments.

You will drive automation, contribute to AI-assisted response pipelines, and balance security with product velocity, reporting to the Head of Enterprise Cyber.

Qualifications

• 6+ years of hands-on experience in Security Operations, Detection Engineering and Cloud Security.
• Proven track record of building and owning defensive infrastructure at scale.
• Strong ability to translate requirements into engineering backlogs and actionables.

Responsibilities

• Automate & Orchestrate: design and optimize SOAR workflows to eliminate manual toil.
• Architect the Defensive Stack: deploy and maintain core defensive tools (SIEM, EDR, DLP, CSPM, CNAPP, DSPM).
• Shift-Left Cloud & Production Infrastructure Security: design secure AWS architectures and hardened Kubernetes base images.
• Engineer the Log Lifecycle: manage ingestion, observability, detection, and automated response workflows.
• Feed the AI Response Pipeline: integrate platform signals into AI-assisted response pipelines.
• Run the Fleet: configure agent policies, patching, and ensuring secure, performant operations.

Skills

Security Operations

Detection Engineering

Cloud Security

Automation

AI Fluency

Threat Modeling

Security Architecture

Tools

SIEM

EDR

DLP

CSPM

CNAPP

DSPM

GuardDuty

EKS

Job description

dLocal enables the biggest companies in the world to collect payments in 40 countries in emerging markets. Global brands rely on us to increase conversion rates and simplify payment expansion effortlessly. As both a payments processor and a merchant of record where we operate, we make it possible for our merchants to make inroads into the world’s fastest-growing, emerging markets.

By joining us you will be a part of an amazing global team that makes it all happen. Being a part of dLocal means working with 1000+ teammates from 30+ different nationalities and developing an international career that impacts millions of people’s daily lives. We are builders, we never run from a challenge, we are customer‑centric, and if this sounds like you, we know you will thrive in our team.

About Us & The Role

dLocal processes billions in payments across 40 emerging markets. The infrastructure behind that runs fast, runs globally, and runs on engineering teams that do not have patience for security that slows things down. Neither do we.

We do not do "check-box" compliance, and we don’t do corporate fluff. Our security function is lean by design and automation‑native by philosophy. We have built a modern stack, a senior team, and a culture where security engineers are expected to think like builders, not gatekeepers. The CISO’s mandate is simple: safely accelerate the business. Everything we build is oriented around that.

Reporting directly to the Head of Enterprise Cyber, this role is the technical backbone of our defensive infrastructure layer. You will own the detection platforms, defensive security tooling, and cloud security engineering that every other security team depends on. This is not a role where you sit inside a tool and tune rules. You will be the person who connects posture signals to response workflows, translates security requirements into engineering backlogs, and builds the infrastructure that makes the rest of the security organization measurably faster.

If your instinct when you see a manual process is to automate it before the week is out, and you get genuinely energized by owning hard infrastructure problems end‑to‑end, this role is built for you.

What You’ll Do

• Automate & Orchestrate: Design and optimize SOAR workflows to eliminate manual toil. If a process is repeatable, you automate it. We keep the team small and senior on purpose: automation and AI do the volume work, people do the judgment.
• Architect the Defensive Stack: Partner with the Cyber Detection & Response (CDR) team to architect, deploy, and maintain the health of our core defensive stack (SIEM, EDR, DLP, CASB, CSPM, DSPM). You ensure the platforms are built to provide the high‑fidelity signals needed to defend the business.
• Shift‑Left Cloud & Production Infrastructure Security: Partner with Cloud & Platform Security (CPS) to design secure‑by‑default AWS architectures, golden AMIs, and hardened Kubernetes (EKS) base images that serve as the blueprint for engineering teams. You will enforce technical guardrails through native AWS resources, advanced CNAPP platform modules, and Preemptive Cloud Security solutions, translating CPS policy requirements into engineering reality and empowering teams with automated tools to build securely without bottlenecks.
• Engineer the Log Lifecycle: Identify, onboarding, and validate log sources across production and enterprise. You own the full log lifecycle: from ingestion and observability pipelines to detection and automated response workflows
• Feed the AI Response Pipeline: Work with the internal security teams to feed platform signals into automated, AI‑assisted response pipelines.
• Run the Fleet: Configure agent policies and manage the underlying infrastructure, including patching and scaling. You make the final call on security‑vs‑productivity trade‑offs, ensuring the fleet is baseline‑secure and performant.

What You Bring

• Track Record That Proves It: 6+ years of hands‑on experience across Security Operations, Detection Engineering, and Cloud Security. What counts is what you built and owned in those years, not what you operated. You have a proven track record of building and owning defensive infrastructure and cloud security at scale.
• Big Owner Mentality & Strategic Alignment: You see the 10,000‑foot strategic goal and relentlessly drive the technical execution to get us there. The CISO and Head of Enterprise Cyber set the direction; the how is yours, and so is its quality. You understand the vision deeply before you build. If you think we are wrong, say it openly and bring the evidence. Convince us and we change course. What you never do is agree in the room and build something else.
• Deep Platform & Cloud Mastery: You possess absolute technical mastery over modern defensive tooling (SIEM, EDR, DLP, CSPM, CNAPP, DSPM) at the configuration and architecture level, not the dashboard level. Same for cloud‑native engineering: advanced AWS security architecture (IAM, SCPs, GuardDuty, and beyond), production EKS hardening, and Kubernetes security from first principles.
• Automation & Orchestration Fluency: You build integrations and automate workflows because doing things manually at scale offends you.
• AI Fluency: You are deeply comfortable using LLMs and AI agents to automate repetitive tasks & workflows, assist response pipelines, and move at 10x speed, while maintaining strict data accuracy.
• Adversary‑Centric Mindset: You build and maintain detections that find real attacker behavior, while also automating the response workflows
• The Security Diplomat (High EQ): You have exceptional cross‑functional range. You can run a threat modeling session with a product team, hand off a prioritized backlog to DevOps, and work Offensive Security findings through to fixes, all while bringing people along and negotiating pragmatic trade‑offs without alienating stakeholders. Stakeholder intelligence is a real skill you have built.
• Pragmatic Operator Mindset: You understand that security cannot kill velocity. Every trade‑off you make keeps the business moving and the environment secure.
• Zero‑Ego Grit: High autonomy means high accountability. You are ruthlessly organized, comfortable with ambiguity, and do not wait for someone to define the path. You have the humility to do the manual work when it needs doing while building the automation to replace it.

Details regarding comprehensive benefits and compensation packages will be discussed directly during the hiring process.