Principal Security Engineer, Defensive Infrastructure

About the role

dLocal is a payments processor and merchant of record operating across 40 emerging markets. Its security function is lean and automation-native, reporting to the Head of Enterprise Cyber. This role is the technical backbone of the defensive infrastructure layer: you own the detection platforms, defensive security tooling and cloud security engineering that other security teams depend on.

Key responsibilities

• Design and optimize SOAR workflows to automate repeatable processes
• Partner with the Cyber Detection & Response team to architect, deploy and maintain SIEM, EDR, DLP, CASB, CSPM and DSPM platforms
• Work with Cloud & Platform Security on secure-by-default AWS architectures, golden AMIs and hardened Kubernetes (EKS) base images, enforced via native AWS resources, CNAPP modules and preemptive cloud security solutions
• Own the log lifecycle: identify, onboard and validate log sources, and build ingestion, observability and detection pipelines
• Feed platform signals into automated, AI-assisted response pipelines
• Configure agent policies, manage patching and scaling, and balance security against productivity

Required profile

• 6+ years of hands-on experience in Security Operations, Detection Engineering and Cloud Security, with a track record of building and owning defensive infrastructure and cloud security at scale
• Big owner mentality: drives technical execution toward the strategic goals set by the CISO and Head of Enterprise Cyber
• Exceptional cross-functional collaboration, able to negotiate trade-offs with product, DevOps and offensive security teams
• Comfortable with ambiguity, autonomous and accountable

Required skills

• Defensive tooling: SIEM, EDR, DLP, CSPM, CNAPP, DSPM at configuration and architecture level
• AWS security architecture (IAM, SCPs, GuardDuty) and production EKS hardening
• Automation and orchestration, including LLMs and AI agents for workflow automation