Senior Security Engineer (Incident Response)

Nubank is hiring a Senior Security Engineer (Incident Response) in São Paulo, Brazil. Level rates it ; you can apply on Nubank.

Level's read on this job

Level rates this cybersecurity role Little AI ●○○○: aI is not part of the work.
The posting allows some remote work.
Tools and skills the posting cites include Python, AWS and Google Cloud.
Level classifies it as a senior role.
Level lists 105 other open roles at Nubank.

AI in this role

Senior Security Engineer for incident response, threat investigation, and security automation workflows.

PythonAWSGoogle CloudAzureSoar

incident-responseautomationcloud-securitythreat-analysiscyber-security

About Nu

Nu serves more than 140 million customers, guided by a mission to fight complexity and empower people. The company has been leading an industry transformation through innovative products and human-centered services.

Proprietary technology and data at scale power Nu’s digital platform, built to promote financial access, advancement, and transparency. Its business model thrives on customer love and lower costs, feeding a flywheel of growth and profitability.

Visit our Institutional Page

About the role

The Nubank Security team actively seeks out potential security threats to protect both our customers and Nubankers. We respond swiftly to security incidents, conduct thorough investigations, and implement measures to mitigate risks. Our strong engineering capabilities allow us to reduce response times through automation and specialized micro-services.

Our Incident Response Team is focused on managing incidents and is constantly enhancing its skills and maturity. Additionally, the Nubank CSIRT is a proud member of the FIRST (Forum of Incident Response and Security Teams) community. You can find more about Nubank Infosec here:

https://blog.nubank.com.br/infosec-nubank-protecao-dados/

You will be responsible for

Investigate complex cases to understand the mechanisms of abuse and guide strategies to mitigate or detect the anomaly
Incident Command: Act as the technical Incident Commander during major crises, coordinating technical workstreams and providing clear, data-driven updates to stakeholders.
Engineering & Automation: Drive the creation and refinement of SOAR playbooks and Python-based tools to automate repetitive tasks and scale the operation.
Data Interpretation: Analyze large datasets to identify emerging threat trends, supporting long-term detection improvements and quantifying risk.

We are looking for a person who has

Proven IR Experience: Solid experience as an Incident Response Analyst/Specialist, with a track record of handling investigations in complex, high-scale environments.
Technical Authority: Deep understanding of security vulnerabilities, attacker TTPs (Mitre ATT&CK), and modern remediation methodologies.
Cloud IR Mastery: Hands-on experience with incident response and management within cloud infrastructures (AWS/GCP/Azure).
Automation Engineering: Strong skills in Python and SOAR platforms to build self-healing or automated response workflows.
Communication: Ability to translate complex technical findings into clear, actionable reports for both technical peers and executive leadership.
English Proficiency: Proficient in both understanding and speaking English for global collaboration.

Location for this opportunity (City, Country)
- São Paulo, Brazil
- Campinas, Brazil
- Rio de Janeiro, Brazil
- Belo Horizonte, Brazil
Benefits
- Chance of earning equity at Nubank
- Food/ Meal Card (Vale-Refeição and/or Vale Alimentação)
- Public Transportation Commuting Benefit (Vale-Transporte)
- NuCare – Psychological, Financial and Legal Assistance Program
- Life Insurance
- Medical Plan
- Dental Plan
- NuLanguage – Language Course Program
- Nucleo - Our learning platform of courses
- Extended Parental Leave
- Daycare Allowance
- Parental Consultancy
- Work-from-home Allowance
- Gym Partnerships
- 30 days of paid vacation
- Relocation Assistance Package, if applicable
Work Model for this Role
Hybrid 2-3 times/week: Our hybrid work model brings us to the office at least twice a week, on strategic days designed to maximize team connection and collaboration. For more details, visit https://building.nubank.com/nu-hybrid-work-model/

Our recruitment process may involve the use of artificial intelligence–enabled tools, such as automated interview transcription and analysis, to support the evaluation process. Artificial intelligence is not used to make final hiring decisions; all decisions are made by human reviewers.

To maintain a consistent and fair process for every candidate, Nu does not provide individualized technical feedback. See how our policy works here

How we rate this

Senior Security Engineer (Incident Response) at Nubank rates 10 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.

Classification

Little AI. AI is not part of the work.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Read the description and count the AI tools, models and workflows it names.

Key facts

Senior Security Engineer (Incident Response) is an open job at Nubank.
Level rates this role AI Level 1 of 4: Little AI.
The role is based in São Paulo and is marked remote.
The job was posted on September 23, 2026.
Seniority: senior.
Applications are handled by Nubank. Apply on Nubank

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

Incident ResponseAutomationCloud SecurityThreat AnalysisCyber SecurityPythonAWSGoogle Cloud

Also common in cybersecurity jobs at this level

Kubernetes Terraform Java C++LLM AI agents

Pay

Typical cybersecurity job: $160k

This posting doesn't list pay. Use the typical cybersecurity figure when pay comes up. See cybersecurity jobs

Questions you could be asked

Tell me about a project where incident response was part of your work. What did you do?
Tell me about a project where automation was part of your work. What did you do?
Tell me about a project where cloud security was part of your work. What did you do?
Tell me about a project where threat analysis was part of your work. What did you do?
Tell me about a project where cyber security was part of your work. What did you do?

Adapt your resume

List these exact terms on your resume: Incident Response, Automation, Cloud Security, Threat Analysis, and Cyber Security. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.

Get your CV reviewed before you apply

Send your CV and the role you want next. Your review arrives by email within 3 days.

Get a free CV review Check your resume with the ATS resume checker