Sr. Cyber Security Analyst - CloudSec

You will support initiatives to improve the security posture of the AWS environment that powers RecargaPay's financial products. You will have full autonomy to drive end-to-end cloud security: identifying and reducing configuration and access risks, responding to incidents, embedding controls into infrastructure-as-code and pipelines, and maintaining compliance with best practices and regulatory requirements alongside infrastructure and engineering teams.

Responsibilities

• Manage the security posture of AWS accounts (Control Tower, Organizations, SCPs, Security Hub, Config, GuardDuty), prioritizing critical findings and driving remediation with engineering teams until closure.
• Review and harden IAM policies, roles, and cross-account access using the principle of least privilege while eliminating static credentials and excessive permissions.
• Investigate and respond to cloud security alerts and incidents (CloudTrail, GuardDuty, VPC Flow Logs), conducting triage, containment, and post-mortems.
• Incorporate security controls into infrastructure as code (Terraform) and CI/CD pipelines (change reviews, policy-as-code, and IaC/image scanning).
• Protect containerized and serverless workloads (EKS/ECS, Lambda) through image baselining, secret management, and network segmentation.
• Produce and maintain control evidence for audits and regulatory requirements (PCI DSS, Central Bank, LGPD) in partnership with Compliance.
• Automate recurring detections and remediations to reduce manual toil and response time.
• Document AWS security standards and guardrails while mentoring engineers in adopting secure practices.

Requirements

• Bachelor's degree (post-graduate degree preferred); 4+ years of experience in Information Security.
• Proven track record of high-impact deliveries.
• Solid experience in information security, with at least 3 years protecting AWS production environments.
• Mastery of AWS IAM (policies, roles, SCPs, cross-account access) and native security services: GuardDuty, Security Hub, CloudTrail, Config, and KMS.
• Knowledge of AWS Control Tower (landing zones, preventive/detective controls, Account Factory, and multi-account governance).
• Familiarity with cloud security best practices and reference frameworks, such as the CIS AWS Foundations Benchmark and AWS Security Maturity Model.
• Hands-on experience with Terraform (or other IaC) and security in CI/CD pipelines, plus incident response in cloud environments.
• Ability to automate security tasks using Python, Bash, or a similar language.
• Nice to have: Experience in fintech, payment processing, or regulated environments (PCI DSS, Central Bank).
• Nice to have: Kubernetes/EKS and container security.
• Nice to have: Experience with SIEM and detection rule creation.
• Nice to have: Certifications such as AWS Certified Security – Specialty or CCSP; intermediate English and Spanish.