Job Description

At R2, we believe that small and medium businesses are the productive engine of society. Small and medium businesses (SMBs) make up over 90% of companies in Latin America, yet they face a trillion-dollar credit gap. Our mission is to unlock SMBs’ potential by providing financial solutions tailored to their needs. We are reimagining the financial infrastructure of Latin America, where SMBs’ financial needs are met without ever having to go to a bank.

R2 enables platforms across Latin America to embed financial services that SMBs can leverage, starting with revenue-based financing. We are a high-performing, close-knit team with talent from organizations such as Google, Amazon, Nubank, Uber, Capital One, Mercado Libre, Globant, and J.P. Morgan.

We are entering a new phase of growth following a strategic investment from Ant International, focused on rapidly expanding our partner footprint, strengthening our credit and underwriting capabilities, and scaling operations across multiple markets. As part of this growth journey, eligible team members have the opportunity to participate in R2’s Phantom Share Program, a performance-based incentive designed to align our team with the company’s long-term success and value creation. We believe in building a culture of ownership, where those who help create value share meaningfully in it.

R2 is scaling quickly, and we're looking for a Cloud Security Engineer (IC3). You will secure R2’s cloud infrastructure and drive the adoption of DevSecOps practices across engineering. You’ll report to the Director of Infrastructure and work closely with our Security, Infrastructure and Platform Engineering teams. We’re looking for someone proactive, detail-oriented, and passionate about technology.

What You'll Do

• Cloud Security Posture
• Operate and improve CSPM, CNAPP and DSPM tooling across R2’s AWS footprint
• Identify, prioritize, triage and track remediation of cloud security findings end-to-end
• Ensure zero open high-severity findings older than 30 days
• IAM, Secrets & Data Protection
• Implement and harden IAM controls, encryption, secrets management and data protection across AWS accounts
• Own secrets rotation and access review processes for production systems
• DevSecOps & Automation
• Integrate security controls into CI/CD pipelines (GitHub Actions, GitLab CI) — SAST/SCA/IaC scanning with blocking criteria for high-severity findings
• Automate security processes via scripting (Python/Bash/Go), APIs and Terraform/IaC
• Network & Perimeter Security
• Manage and harden network security controls — WAF rule sets, security groups, NACLs, and network segmentation across VPCs
• Tune and maintain AWS WAF rate-limiting thresholds and manage rule groups against scanning and malicious traffic
• Enforce least-privilege network access across accounts and environments
• GenAI & Agent Security
• Contribute to securing R2’s GenAI applications, RAG architectures, agents, APIs, connectors and MCP servers
• Design and build internal AI/LLM-based security agents to automate threat detection, finding triage, and incident response.
• Define controls against data leakage, improper access, prompt injection and unsafe tool use by autonomous agents
• SOC & Detection
• Collaborate with the SOC on alert integration and use-case development in SIEM
• Cross-functional
• Build and maintain security documentation, runbooks and standards
• Support incident response, root cause analysis and remediation across production environments

Who You Are

• 3–5 years of experience in cloud security, DevSecOps or a similar role
• Hands-on experience with CSPM/CNAPP/DSPM platforms (Wiz, Prisma Cloud, Orca or equivalent)
• Strong AWS security knowledge (IAM, KMS, Secrets Manager, Security Hub, GuardDuty, Inspector)
• Experience embedding security into CI/CD pipelines and Infrastructure as Code (Terraform)
• Scripting ability (Python, Bash; Go a plus) for security automation via APIs
• Familiarity with Kubernetes/EKS and container security
• Experience hardening network security controls (WAF, security groups, NACLs, VPC segmentation)
• Understanding of GenAI/LLM security risks (prompt injection, agentic tool misuse, data leakage)
• English proficiency — written and spoken (required)

Nice to Have

• AWS Certified Security – Specialty
• Experience with SIEM/SOAR platforms
• Familiarity with ISO 27001, SOC 2, or similar compliance frameworks
• Fintech or regulated-industry experience

What We Offer

• The chance to join a high-impact, mission-driven fintech.
• Ownership and impact in a fast-paced, growth-oriented startup.
• Cross-functional collaboration with exceptional teams.
• Exposure to complex regulatory challenges and innovation in embedded finance.

Locations: Buenos Aires, São Paulo, Bogotá, Santiago