Staff Security Engineer (IAM)

Nubank•Miami, FL

1d•$200,000 - $240,000•Hybrid

About The Position

Nubank is seeking a Staff Security Engineer to contribute to its Identity and Access Management (IAM) security function in a financial technology organization serving customers across Brazil, Mexico, and Colombia. This senior individual-contributor role has organizational-level technical influence and is responsible for supporting a multi-year IAM security strategy, directing execution across engineering teams, and ensuring identity and access controls meet security, regulatory, and operational requirements across multiple jurisdictions. The role calls for a hands-on security engineering leader with a history of delivering consequential programs, including programs that faced setbacks. The position emphasizes security as a means of enabling business outcomes: identifying controls that reduce real risk, taking ownership of results, and questioning whether existing measures are necessary, sufficient, and proportionate. The Staff Security Engineer will guide IAM strategy and implementation, lead authentication migrations and identity infrastructure work, establish measurable least-privilege practices, respond to identity-related incidents, and advise internal and external stakeholders on identity and access control. The role also includes mentoring senior engineers, supporting hiring and career decisions, and leading preparedness exercises and university projects. The position is hybrid, with office attendance at least twice a week, and is available in Miami, Palo Alto, or Washington, DC. Compensation is listed as $200,000–$240,000 plus RSUs.

Requirements

Solid professional experience in security engineering, concentrated in identity, authentication, or access management.
Demonstrated track record leading complex, multi-year security programs from conception through measurable outcomes, including programs involving organizational obstacles, technical constraints, or material mid-course corrections.
Expert-level knowledge of IAM and authentication protocols, including OIDC, OAuth 2.0, SAML 2.0, FIDO2/WebAuthn, mTLS, and PKI.
Ability to produce, review, and reason about production-quality code in at least one general-purpose programming language.
Ability to model identity-related threat scenarios, assess attacker techniques relevant to IAM, and design controls that remain effective under adversarial conditions.
Commitment to security as an organizational capability that enables business outcomes, including solving real security problems, challenging inherited assumptions, and distinguishing genuine risk reduction from security theater or responsibility transfer.
Experience communicating technical risk assessments and strategic recommendations to senior non-technical stakeholders, including executives and regulators.

Nice To Haves

Experience in a financial services institution or similarly regulated environment subject to multiple concurrent regulatory frameworks.
Hands-on experience administering or integrating with an enterprise Identity Provider at scale, particularly Okta or Keycloak.
Experience designing and enforcing security controls for third-party, BPO, or partner environments without direct operational control of partner infrastructure.
Experience leading organizational adoption of Zero Trust architecture, including authentication and authorization for hybrid and multi-cloud environments.
Contributions to the broader security community, such as published research, conference presentations, open-source tooling, or participation in standards bodies.

Responsibilities

Define, communicate, and execute a multi-year security strategy, particularly in IAM, aligned with organizational risk, regulatory obligations, and business objectives across countries and jurisdictions.
Lead organization-wide authentication migrations across browser, operating system login, CLI, and API surfaces, targeting authentication success rates above 99%, reduced authentication time, support exception rates below 1%, and return on investment within weeks of enforcement.
Design and maintain core identity infrastructure, including an enterprise Identity Provider, PKI and X.509 certificate lifecycle automation, mutual TLS for service-to-service authentication, and credential management systems.
Translate least-privilege access into a measurable organization-wide program with defined metrics, adoption tracking, and accountability structures.
Design and maintain a security engineering framework of technical mechanisms, policies, incentives, and assurance processes that makes security properties durable, verifiable, and operationally sound.
Lead technical incident response for identity and access security events, including remote access infrastructure vulnerabilities; investigate incidents, document root causes, and implement structural improvements.
Design and facilitate large-scale preparedness exercises based on realistic attack paths and involving engineering, operations, and executive functions.
Mentor and coach senior engineers; lead innovative projects with universities; and collaborate on hiring and career decisions.
Serve as the technical authority in engagements with Legal, Compliance, internal audit, and external regulators on identity, authentication, and access control.