{"id":1008010,"url":"https://alion.io/job/nelo-senior-security-engineer","title":"Senior Security Engineer","company":{"id":62836,"name":"Nelo","domain":"nelo.mx","url":"https://alion.io/company/nelo","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Mexico City, Mexico"],"countries":["MX"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":49000,"max_usd":114000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Claude Code","optional":false},{"name":"Go","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false}],"status":"live","first_seen_at":"2026-09-17T15:06:54Z","employer_posted_date":"2026-09-17","last_verified_at":"2026-10-26T02:29:55Z","board_verified":true,"closed_at":null,"days_open":38,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":38},"description":"Security Engineer\nAbout Nelo\nNelo is a leading fintech in Mexico reimagining credit to expand consumer buying power. Founded in 2019 by former Uber international growth team leads Kyle Miller and Stephen Hebson, Nelo offers credit cards, BNPL loans, bill payments, and its own marketplace - all under one app - designed from first principles for a mobile-first, real-time payments world.\nWith $100M in annual revenue, $1B in annualized GMV, and $140M+ raised in equity and debt, Nelo is one of the most capital-efficient consumer fintech companies in Latin America. The company is profitable - positive operating profit in both 2024 and 2025. It runs lean and technical: 60 employees, 8 engineers, with AI driving underwriting, collections, and operations.\nHQ: Mexico City, Mexico; commercial and people operations in New York City\n\nFounded: 2019\n\nTeam size: 60 FTEs\n\nOpen roles: 10+\n\nWebsite: nelo.mx\n\nStage: Post-Series A; $100M credit facility (Victory Park Capital, 2022); profitable\n\nBenefits: 401k, open PTO, medical, dental, vision, STD, LTD, fertility\n\nCompany values:\nBe your best selves: ambition, hard work, intellectual curiosity\n\nEveryone is an owner: all employees receive equity including customer support; 10-year option expiration; equity refreshers\n\nCustomer first: product decisions grounded in customer benefit\n\nOpen and honest communication: quarterly financials and board presentations shared company-wide; low tolerance for bureaucracy or gossip\n\nMove fast, learn fast: hundreds of experiments run monthly; rigorous experimentation cultureAbout the role\n\nSecurity has been part of how Nelo builds software from day one. As we scale, we are creating a dedicated Security Engineer role with broad ownership across application security, cloud infrastructure, and internal controls.\nThis is a hands-on role for someone who wants to define the security function rather than inherit it. You will decide where to invest, implement controls yourself, and balance risk against velocity in a fast-moving lending business. You will work directly with the CTO, the CEO, and engineering leadership.\nThis role is in-person at our Mexico City office in Condesa.\nWhat you'll do\nBuild secure-by-default systems\nDesign and implement security guardrails across cloud infrastructure and developer workflows\n\nImprove IAM, secrets management, endpoint management, and access controls across production systems\n\nHarden AWS infrastructure using Terraform and policy-as-code\n\nIncrease observability for security-relevant events and anomalies\n\nTreat security as an engineering problem\nWrite code, configs, and tooling to enforce controls\n\nReplace manual reviews with automation wherever it makes sense\n\nMake the secure path the default path for engineers\n\nRun external security programs\nOwn penetration tests and the bug bounty program end-to-end\n\nTriage findings, partner with engineers on fixes, and turn one-off issues into systemic improvements\n\nDrive certifications and compliance\nTake Nelo through SOC 2 Type 1 and Type 2\n\nBuild automated evidence collection so compliance does not become a recurring tax on the team\n\nRaise the bar across engineering\nSet the standard through your own implementations\n\nReview designs and PRs with a security-first lens\n\nWhy you should apply\nYou have built security programs at a startup before and know the difference between security theater and controls that actually reduce risk. You can tell which one a given investment is.\n\nYou write code and ship infrastructure yourself. Terraform, Python, Go, whatever the job calls for. You do not hand off implementation to someone else and call it done.\n\nYou have deep AWS instincts. You know where the sharp edges are in IAM, how to read CloudTrail, when GuardDuty findings matter and when they are noise.\n\nYou have taken a company through SOC 2 or a comparable certification and you know how to run it without grinding engineering to a halt. Automated evidence collection is the baseline you build toward, not a stretch goal.\n\nYou are comfortable with AI tools as part of your daily workflow. You use Claude Code or similar to move faster, and you have opinions about where they belong in a security review and where they do not.\n\nYou can hold a strong security position and still ship product on time. You see velocity and security as the same problem, not opposing ones.\n\nWhy you should NOT apply\nYou want to manage a team of security engineers. There is no team to manage. You are the team, at least for the foreseeable future. If your value is in delegating, this role will not fit.\n\nYou see security as a gatekeeping function. The job is to make the secure path the easiest path, not to block PRs and write policy documents that nobody reads. If your instinct is to slow things down rather than redesign them, the engineering team will route around you.\n\nYou need a mature environment with established tooling and processes. Some of this exists. Most of it does not. You are building the function, not stepping into one.\n\nYou treat compliance as a separate workstream from engineering. SOC 2 evidence at Nelo will be collected by code, not by a GRC tool with a person filling out questionnaires. If that distinction is not natural to you, this will feel like the wrong job.\n\nYou think AI tools are a gimmick. Every team at Nelo uses AI in daily workflows. If you are skeptical of agentic coding tools or refuse to use them, you will be working against the grain of how engineering moves here.\n\nHow we work\n~60 people across CDMX and New York. Lean, fast, opinionated about quality.\n\nThis role is based in Mexico City and is expected to be in-office given the proximity required with engineering and infrastructure work.\n\nEvery team at Nelo uses AI in daily workflows. Engineering is no exception.\n\nWho you are\nRequired\nEngineering background with substantial time spent on security in production environments\n\nStrong hands-on experience with cloud security fundamentals, ideally on AWS\n\nComfortable building and modifying infrastructure with Terraform or equivalent IaC tooling\n\nYou ship code and own outcomes, not just recommendations\n\nStrong signals\nYou have taken a company through SOC 2, ISO 27001, or a comparable certification\n\nYou have personally run a bug bounty program or managed external pentests\n\nDepth in AWS security primitives such as GuardDuty, CloudTrail, IAM, VPC, KMS, and security groups\n\nYou use Claude Code or other agentic coding tools as part of your daily workflow\n\nInterview process\nConversation with the hiring manager\n\nCase study\n\nOn-site panel\n\nFast decision\n\nCompensation and benefits\nCompetitive salary and meaningful equity\n\n100% medical, dental, and vision coverage\n\nUnlimited PTO and extended parental leave","description_format":"text","description_chars":6729,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Equity","Parental leave","Unlimited PTO"],"hiring_locations":[{"name":"Mexico","iso":"MX","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Buy Now, Pay Later"],"lifecycle":[{"event":"open","at":"2026-09-17T18:39:28Z"}],"visa":[],"liveness":{"score":76,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.841,"p_room":0.9,"age_days":37,"expected_fill_days":69,"reasons":["conf:1","win:mid"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/nelo-senior-security-engineer","json_url":"https://alion.io/job/nelo-senior-security-engineer.json","meta":{"generated_at":"2026-10-26T03:55:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5360,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":62836},"rest":"https://alion.io/mcp/rest/get_company?id=62836"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fnelo-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fnelo-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fnelo-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/nelo-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fnelo-senior-security-engineer"}]}