Head of Security

Head of Security
Overview
Tonder is building payments infrastructure for Latin America, and security is a core part of the product.
We’re looking for a Head of Security to own and continuously strengthen Tonder’s security program across infrastructure, engineering, compliance, and operations.
This is a hands-on leadership role. You’ll define the security roadmap, work directly with Engineering and leadership, and make sure security controls are not only documented, but actually implemented, automated, monitored, and improved over time.
We want someone who can combine strong technical judgment with execution — from cloud security and DevSecOps to PCI, incident response, risk management, and security architecture.
What you’ll own
Own Tonder’s security strategy, roadmap, priorities, and overall security posture.
Lead cloud security, application security, infrastructure security, IAM, secrets management, and production access controls.
Build security directly into the engineering lifecycle through DevSecOps, CI/CD controls, automated testing, scanning, and remediation.
Own vulnerability management from detection through remediation and validation.
Lead security incident response, investigation, containment, root-cause analysis, and post-incident improvements.
Own and continuously improve PCI DSS and other relevant security and compliance programs.
Work closely with Engineering to review architecture, identify risks, and define secure-by-design controls.
Build automated and AI-assisted security workflows for monitoring, evidence collection, remediation, analysis, and operational security tasks.
Own third-party security reviews, vendor security assessments, penetration testing, and remediation programs.
Define security metrics, dashboards, alerts, and reporting for leadership.
Continuously identify systemic risks and turn them into durable technical controls instead of recurring manual processes.
Help build the security team, processes, and operating model as Tonder scales.
What we’re looking for
Strong experience leading security in fintech, payments, financial services, or another highly regulated environment.
Deep understanding of AWS security, IAM, networking, secrets, cloud architecture, and production systems.
Strong experience with DevSecOps, application security, infrastructure security, and vulnerability management.
Experience with PCI DSS and security compliance programs.
Strong understanding of incident response, threat modeling, security architecture, and risk management.
Ability to go deep technically while also setting strategy and priorities.
Experience working directly with engineering teams and senior leadership.
Strong automation mindset and ability to turn security requirements into code, tooling, and workflows.
Advanced use of AI for security analysis, automation, monitoring, and engineering productivity.
High ownership, urgency, and the ability to drive security projects from risk identification through actual remediation.

Work arrangement
Yes