The company:

Capital Markets Gateway (CMG) is a financial technology firm that is modernizing the equity capital markets (ECM).CMG connects investors and underwriters via a neutral platform that delivers integrated ECM data and analytics, transparency, and workflow efficiencies. Providing a digital system of record for firm-wide deal activity, CMG helps clients make more timely, better-informed decisions.

Launched in 2017 by a team of ECM practitioners, the CMG platform is currently relied upon by nearly 100 buy side firms representing $20 trillion in AUM and 15 investment banks. CMG’s goal is to alleviate pain points resulting from disparate solutions, fragmented data, and frenzied communication. CMG’s DataLab product solves for data analytics, while CMG’s XC platform establishes connectivity between buy- and sell-side firms.

This role requires to be based in Latin America.

Position Overview:

CMG is seeking a proactive and highly skilled Senior Security Engineer focused on Cloud & DevSecOps to drive and elevate the security posture across our cloud infrastructure, applications, and DevOps practices. This role merges the responsibilities of securing cloud environments and integrating security into development pipelines, ensuring the safety of both infrastructure and application code. The successful candidate will collaborate closely with various teams, including Security, DevOps, and Engineering, to identify risks, implement security controls, and continuously improve security processes. This is a hands-on role focused on cloud security architecture, application security, and security automation.

Key Responsibilities:

Cloud & Infrastructure Security

Design, implement, and evolve cloud security architecture strategies and frameworks across multi-cloud platforms (i.e., Azure and either AWS/GCP).
Conduct risk assessments and secure cloud environments using Infrastructure as Code (IaC) tools like Terraform, ensuring compliance with security standards and policies.
Partner with DevOps on cloud security initiatives, including network security, data protection, secure configurations, and encryption.
Ensure cloud-native services are secured, such as identity management, storage, and compute resources, while ensuring adherence to regulatory and industry standards.

Application Security & DevSecOps

Integrate security best practices into the Software Development Life Cycle (SDLC), focusing on secure coding, dependency management, and continuous vulnerability scanning for languages such as .NET, JavaScript, and Python.
Collaborate with development teams to establish security standards and enforce secure coding practices.
Implement and maintain API security standards, including authentication, encryption, and secrets management.
Ensure containerized applications are secured deployed via Kubernetes, managing both image security and runtime security risks.
Perform threat modeling and risk assessments for both new and existing applications.
Implement and maintain any required security audit trails and/or integrations into security monitoring apparatus

Security Automation & Compliance

Develop policy-as-code frameworks and automate security testing in CI/CD pipelines using tools like GitHub Actions, ensuring security is continuously enforced during deployments.
Monitor, assess, and mitigate vulnerabilities in cloud infrastructure, application environments, and containers through regular scans and risk assessments.
Drive the adoption of security automation tools to streamline secure deployments, enforce security policies, and manage cloud configurations.
Support security compliance initiatives, including SOC2, ensuring cloud infrastructure and applications meet regulatory standards.

Security Governance & Leadership

Mentor engineers and cross-functional teams, advocating for security best practices across cloud, infrastructure, and applications.
Serve as the subject matter expert in security architecture areas such as identity management, encryption, data loss prevention (DLP), and cloud service security.
Develop and maintain security documentation, policies, and procedures for cloud, application, and DevOps environments.
Stay informed on emerging threats and security technologies, driving continuous improvement and innovation in cloud and application security.

Required Qualifications

Must be based in LATAM
English level - C1 or C2
7+ years of hands-on experience in information security, with a strong focus on cloud and application security.
4+ years of experience securing cloud platforms (Azure preferred, AWS, GCP), including deep expertise with cloud-native security tools and Infrastructure as Code (Terraform).
Proven track record securing application environments and integrating security into DevOps practices.
Strong understanding of API security, encryption, and secrets management in distributed cloud environments.
Hands-on experience with automation tools like Terraform and Ansible, and security-focused CI/CD pipelines.
Expertise in securing containerized environments (Docker, Kubernetes) and addressing vulnerabilities in container images and dependencies.
Strong knowledge of cryptography, key management, and data protection best practices.

Key Technologies

CloudPlatforms: Azure (preferred), GCP, AWS
Infrastructure-as-Code (IaC): Terraform
Languages: .NET, JavaScript, Python, Bash, Powershell
Containers: Docker, Kubernetes
CI/CD Tools: GitHub
Database: PostgreSQL
Secrets Management: Key Vault
Operating Systems: Linux, Windows, MacOS

Desired Qualities

Strong ownership and initiative, with the ability to work independently in a fast-paced environment.
Excellent multitasking and prioritization skills, capable of handling complex, concurrent tasks.
Passion for security innovation, staying ahead of emerging threats, and continuously improving security processes.
Detail-oriented, ensuring thorough tracking of issues and resolutions.

Our values

We innovate with purpose
We focus on outcomes vs. output
We believe diverse and inclusive teams fuel innovation
We are humble yet candid
We do right by the customer

What we offer

2 year+ contract
15 days of vacation
Tech courses and conferences
Top-of-the-line MacBook
Flexible working hours

We celebrate diversity and are committed to creating an inclusive work environment. CMG is an equal-opportunity employer.

Choose your preferred Setup:

Impact Organisations

Remote Fractional Roles

Remote Full-time Roles

Capital Markets Gateway jobs

Senior Security Engineer – Cloud & DevSecOps - Latin America