Staff Security Engineer (IAM)

Nubank•Miami, FL

2d•$200,000 - $240,000•Hybrid

About The Position

Nu is seeking a Staff Security Engineer to contribute to the Identity and Access Management (IAM) security function across a financial technology organization serving more than 100 million customers in Brazil, Mexico, and Colombia. This is a senior individual-contributor role with organizational-level technical influence. The role supports a multi-year IAM security strategy, directs execution across multiple engineering teams, and ensures identity and access controls meet the security, regulatory, and operational needs of a globally operating financial institution. The position calls for a record of delivering consequential security programs, including those that encountered setbacks, and technical judgment grounded in sustained hands-on experience. Its security engineering approach emphasizes business enablement: distinguishing controls that reduce real risk from measures that only create the appearance of compliance, taking ownership of outcomes, and continually questioning assumptions about which security measures are necessary, sufficient, and proportionate. The role defines and executes IAM security strategy; leads organization-wide authentication migrations; designs and maintains identity infrastructure, including an enterprise Identity Provider, PKI and X.509 certificate lifecycle automation, mutual TLS, and credential management systems; and builds measurable least-privilege and security engineering programs. It also leads identity-related incident response and preparedness exercises, mentors senior engineers, collaborates on hiring and career decisions, and serves as a technical authority in discussions with Legal, Compliance, internal audit, and external regulators. The role is based in Miami, Palo Alto, or Washington, DC, and follows a hybrid model requiring office attendance at least twice weekly. Compensation is listed as $200,000–$240,000 plus RSUs.

Requirements

Solid professional experience in security engineering, concentrated in identity, authentication, or access management.
Demonstrated track record leading complex, multi-year security programs from conception through measurable outcomes, including navigating organizational obstacles, technical constraints, or material mid-course corrections.
Expert-level knowledge of IAM and authentication protocols, including OIDC, OAuth 2.0, SAML 2.0, FIDO2/WebAuthn, mTLS, and PKI.
Ability to produce, review, and reason about production-quality code in at least one general-purpose programming language.
Ability to model identity-related threat scenarios, assess attacker techniques relevant to IAM, and design controls that remain effective under adversarial conditions.
Commitment to security as an organizational capability that enables business outcomes, including solving real security problems, challenging inherited assumptions, and distinguishing risk reduction from security theater or responsibility transfer.
Experience communicating technical risk assessments and strategic recommendations to senior non-technical stakeholders, including executives and regulators.

Nice To Haves

Experience in a financial services institution or similarly regulated environment subject to multiple concurrent regulatory frameworks.
Hands-on experience administering or integrating with an enterprise Identity Provider at scale, particularly Okta or Keycloak.
Experience designing and enforcing security controls for third-party, BPO, or partner environments without direct operational control of partner infrastructure.
Experience leading organizational adoption of Zero Trust architecture, including authentication and authorization mechanisms for hybrid and multi-cloud environments.
Contributions to the broader security community through published research, conference presentations, open-source tooling, or participation in standards bodies.

Responsibilities

Define, communicate, and execute a multi-year security strategy, especially in IAM, aligned with organizational risk posture, regulatory obligations, and business objectives across multiple countries and jurisdictions.
Lead organization-wide authentication migrations across browser, operating system login, CLI tooling, and API integrations, targeting authentication success above 99%, reduced authentication time, support exception rates below 1%, and return on investment within weeks of enforcement.
Design and maintain core identity infrastructure, including an enterprise Identity Provider, PKI and X.509 certificate lifecycle automation, mutual TLS for service-to-service authentication, and credential management systems.
Translate least-privilege access into a measurable organization-wide program with defined metrics, visible adoption, and accountability structures.
Design and maintain a security engineering framework of technical mechanisms, policies, incentives, and assurance processes that makes security properties durable, verifiable, and operationally sound.
Lead technical incident response for identity and access security events, investigate events, document root causes, and implement structural improvements to reduce recurrence likelihood and impact.
Design and facilitate large-scale preparedness exercises based on realistic attack paths involving engineering, operations, and executive functions.
Mentor and coach senior engineers; lead innovative projects with universities; and collaborate on hiring and career decisions.
Serve as technical authority in engagements with Legal, Compliance, internal audit, and external regulators on identity, authentication, and access control.