Skip to content

IAM

Staff Security Engineer (IAM)

Nubank logoNubankSão PauloFull-timePosted 3mo ago
Apply on Nubank (shows the role here)Nubank as an employer: salaries and roles

The full posting

About Nu

Nu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services.

Proprietary technology and data at scale power Nu’s digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability.

Visit our Institutional Page

About the Role

Nubank is seeking a Staff Security Engineer to contribute in the Identity and Access Management security function across a financial technology organization serving over 100 million customers in Brazil, Mexico, and Colombia. This is a senior individual-contributor role with organizational-level technical influence, responsible for supporting a multi-year IAM security strategy, directing its execution across multiple engineering teams, and ensuring that identity and access controls meet the security, regulatory, and operational requirements of a globally operating financial institution.

The Staff Security Engineer is expected to bring a demonstrated history of delivering consequential security programs - including programs that encountered setbacks - and the technical judgment that only sustained, hands-on experience in the domain produces. Critically, this role requires a security engineering philosophy grounded in business enablement: the conviction that security done well accelerates what the organization can do, not merely protects it. This means rigorously distinguishing between controls that reduce real risk and those that create the appearance of compliance without reducing exposure, taking genuine ownership of outcomes rather than delegating accountability through policy, and continuously questioning inherited assumptions about what security measures are necessary, sufficient, or proportionate.

What You’ll Be Responsible For

  • Defining, communicating, and executing a multi-year security strategy (especially in the IAM field) aligned with the organization's risk posture, regulatory obligations, and business objectives across multiple countries and regulatory jurisdictions.
  • Lead organization-wide authentication migrations that span heterogeneous surfaces - browser, operating system login, CLI tooling, and API-level integrations - across thousands of employees, multiple device ecosystems, and distributed work environments, producing measurable outcomes: authentication success rates above 99%, material reductions in per-authentication time, support exception rates below 1%, and return on investment within weeks of enforcement.
  • Designing and maintaining the core identity infrastructure with the durability and operational discipline required at organizational scale: enterprise Identity Provider, PKI and X.509 certificate lifecycle automation, mutual TLS for service-to-service authentication, and credential management systems engineered to remain sound as the organization grows.
  • Translating least-privilege access from a principle into a measurable, organization-wide program - with defined metrics, visible adoption curves, and accountability structures that allow Security and Engineering leadership to track and act on the organization's access risk posture over time.
  • Designing and maintaining a security engineering framework - comprising technical mechanisms, policies, incentives, and assurance processes - that ensures security properties are durable, verifiable, and operationally sound, rather than dependent on individual vigilance or periodic audits.
  • Leading technical incident response for identity and access security events, including critical vulnerabilities in remote access infrastructure, ensuring thorough investigation, documented root cause analysis, and structural improvements that reduce the likelihood and impact of recurrence.
  • Designing and facilitating large-scale preparedness exercises grounded in realistic attack paths - involving engineering, operations, and executive functions - to identify genuine gaps in IAM controls, not merely satisfy a compliance requirement.
  • Providing technical mentorship and coaching to senior engineers; lead innovative projects with universities and actively collaborate in hiring and career decisions in order to maintain a high technical standard throughout the safety organization.
  • Serving as the technical authority in engagements with Legal, Compliance, internal audit, and external regulators on matters related to identity, authentication, and access control.

Must-have

  • Solid professional experience in security engineering, with a concentration in identity, authentication, or access management.
  • Demonstrated track record of leading complex, multi-year security programs from conception through measurable outcome - including programs that required navigating organizational obstacles, technical constraints, or material mid-course corrections.
  • Expert-level knowledge of IAM and authentication protocols: OIDC, OAuth 2.0, SAML 2.0, FIDO2/WebAuthn, mTLS, and Public Key Infrastructure (PKI).
  • Proficiency in software engineering: ability to produce, review, and reason about production-quality code in at least one general-purpose programming language.
  • Demonstrated ability to model identity-related threat scenarios, assess attacker techniques relevant to the IAM surface, and design controls that remain effective under adversarial conditions.
  • A demonstrable commitment to security as an organizational capability that enables business outcomes: a track record of solving real security problems, a disposition to challenge inherited security assumptions, and a clear pattern of distinguishing genuine risk reduction from security theater or responsibility transfer.
  • Experience communicating technical risk assessments and strategic recommendations to senior non-technical stakeholders, including executives and regulators.

Nice-to-have

  • Experience operating within a financial services institution or similarly regulated environment subject to multiple concurrent regulatory frameworks.
  • Hands-on experience administering or integrating with an enterprise Identity Provider at scale, particularly Okta, or Keycloak.
  • Experience designing and enforcing security controls for third-party, BPO, or partner environments without direct operational control of the partner's infrastructure.
  • Experience leading organizational adoption of Zero Trust architecture, including authentication and authorization mechanisms for hybrid and multi-cloud environments.
  • Contributions to the broader security community - published research, conference presentations, open-source tooling, or participation in standards bodies.

Location for this opportunity (City, Country)

  • Campinas, Brazil
  • São Paulo, Brazil
  • Rio de Janeiro, Brazil
  • Belo Horizonte, Brazil

Our Benefits

  • Chance of earning equity at Nubank
  • Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
  • Public Transportation Commuting Benefit (Vale-Transporte)
  • NuCare – Psychological, Financial and Legal Assistance Program
  • Life Insurance
  • Medical Plan
  • Dental Plan
  • NuLanguage – Language Course Program
  • Nucleo - Our learning platform of courses
  • Extended Parental Leave
  • Daycare Allowance
  • Parental Consultancy
  • Work-from-home Allowance
  • Gym Partnerships
  • 30 days of paid vacation
  • Relocation Assistance Package, if applicable

Work Model for this Role

Hybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration. For more details, visit https://building.nubank.com/nu-hybrid-work-model/

Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.

To maintain a consistent and fair process for every candidate, Nu does not provide individualized technical feedback. See how our policy works here

Text as Nubank published it; last compared with the original on 12 Nov 2026.

Apply on Nubank (shows the role here)

The application

Your details, LinkedIn and CV, then 14 questions.

Keep these to handLinkedInCV
  1. 1.
    What is your level of English proficiency?Choose one
  2. 2.
    Do you have solid hands-on experience in security engineering roles?Yes or no
  3. 3.
    Have you led and owned a security program, from conception through outcome measurement, that operated at organizational scale, involving multiple business units, functions, or geographies?Yes or no
  4. 4.
    Have you implemented or architected solutions using the following protocols in production environments: OIDC, OAuth 2.0, SAML 2.0, FIDO2/WebAuthn, mTLS, PKI?Yes or no
  5. 5.
    Do you have the ability to produce, review, and reason about production-quality code in at least one general-purpose programming language?Yes or no
  6. 6.
    Which programming language(s) are you most comfortable working in?Short answer
  7. 7.
    Have you conducted threat modeling exercises specifically targeting IAM attack surfaces (e.g., token abuse, credential stuffing, privilege escalation) and translated those findings into implemented controls?Yes or no
  8. 8.
    Have you presented a security risk assessment or strategic recommendation directly to C-level executives or external regulators?Yes or no
  9. 9.
    Are you available to work onsite two to three days per week?Yes or no
  10. 10.
    Are you legally authorized to work in the country where this position is located?Yes or no
  11. 11.
    Will you require sponsorship for employment visa status now or in the future?Yes or no
  12. 12.
    Do you require relocation for this role?Choose one: No, I don't require relocation · Yes, I require relocation and am willing to relocate · Yes, I require relocation but am not willing to relocate
  13. 13.
    Have you previously worked at Nubank or any company acquired by Nubank?Yes or no
  14. 14.
    Have you participated in a hiring process with Nubank in the last 6 months?Yes or no

Taken from Nubank's application form as it stood on 12 Nov 2026.

The employer: Nubank

Runs a branchless bank and card business in Brazil, Mexico and Colombia; seven security openings cover AI, mobile, IAM and PCI compliance work.

Pay and benefits: Salaried engineering and leadership roles, office-based in São Paulo, Palo Alto or Miami.

Full postings from Nubank All Nubank openings on the board Nubank employer profile

Other security roles worth a look

A few links on CyberJobs.cc are referral links: when one leads to a hire, a sign-up or a purchase (a lab, a course or a tool marked Partner), the company behind it may pay CyberJobs.cc a fee. You pay nothing extra, and it never changes the salary an employer offers you or which roles the board lists. Roles from partners who pay us a fee rank a little higher in this list.

Let security teams come to you

Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.

Create my profile

Hear first when Nubank posts a security role

We read Nubank's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.

Staff Security Engineer (IAM) at Nubank | CyberJobs.cc