Clara is the leading platform in Latin America for companies to execute and manage every payment operation. More than 50,000 leading and fast-growing businesses run on our corporate cards, bill pay, financing and B2B payments, and in 2025 the Financial Times named Clara the region’s fastest-growing company. We’re passionate about helping every company we work with become more effective—and, through that, raising the region’s competitiveness. We’re ~400 people, backed by Notable Capital, Coatue, Kaszek, monashees, DST Global, ICONIQ, General Catalyst and Goldman Sachs, among others.

Security Engineer

What you'll do

You will own outcomes, not a queue. You'll lead workstreams across the security function, pair with and mentor early-career engineers, and be trusted to make calls without waiting for sign-off.

Own the AI security posture, enabling rather than blocking

• Define and operate the controls for how Clara uses LLMs, coding agents, agentic browsers, MCP integrations and internal inference gateways: data handling, identity, permissions, logging
• Own the LLM-based investigation agent on the SIEM: design its instructions and rules, evaluate its accuracy, catch hallucinated attributions and unsupported conclusions, and decide what it is allowed to close autonomously
• Threat-model AI systems as first-class attack surface: prompt injection, data exfiltration through AI tools, over-privileged agents, model and tool supply chain
• Build the guidance and paved paths that let product and engineering adopt AI safely by default, and be a credible voice in those decisions

Cloud security on AWS and GCP

• Own detection and posture across AWS (GuardDuty, IAM, VPC, CloudTrail) and GCP (Security Command Center, IAM, service accounts, org policies), and drive remediation with the owning teams
• Design and implement guardrails as code: organization policies, SCPs, IAM boundaries, infrastructure-as-code policy checks
• Lead parts of our large-scale GCP project inventory and cleanup program, and turn one-off findings into automated controls
• Secure identity and edge: Auth0, Cloudflare, Google Workspace, SSO and service-to-service authentication

Secure code, CI/CD and application security

• Run and evolve the application security program: SAST (SonarQube, Semgrep or similar), dependency and secrets scanning, PR review for security-sensitive changes, and CI/CD pipeline hardening
• Review architecture and code for new products and integrations (card issuing, payments, banking partners) and produce actionable, prioritized findings