[Hiring] SecOps Engineer @Addi

Role Description

This is where you come in. Below, you’ll find what this role is all about—the impact you’ll drive, the challenges you’ll tackle, and what it takes to thrive at Addi. If you’re ready to be part of something big, keep reading.

What’s the mission you’ll drive

• Own the implementation and day-to-day operation of security controls across endpoints, infrastructure, secure connectivity, and data protection.
• Work closely with IT and engineering to detect threats early, respond quickly, and protect Addi’s environment at scale.

What you will do

• Execute the migration to the selected XDR platform across endpoints and infrastructure, achieving ≥95% endpoint coverage by May 2025.
• Reduce false positives by ≥30%, and support a Mean Time to Detect (MTTD) of under 1 hour for high-severity incidents through stable, reliable XDR operations.
• Implement and operate DLP and SASE controls to secure user access, SaaS usage, and data flows.
• Enforce DLP policies across ≥90% of managed users and devices, reducing high-risk data exposure events by ≥30%.
• Ensure minimal impact to user productivity, with SASE fully deployed by end of April 2025.
• Deploy and operate a centralized MDM solution to manage and secure corporate endpoints, achieving ≥95% device enrollment by May 2025.
• Enforce baseline security configurations and reduce endpoint-related security incidents through consistent policy enforcement.
• Implement and maintain endpoint security policies including encryption, OS hardening, patching, and access controls.
• Ensure ≥95% compliance with defined device security baselines and timely remediation of non-compliant devices.
• Operate and continuously improve SIEM detections and SOAR playbooks for security events across critical platforms.
• Reduce Mean Time to Respond (MTTR) by ≥50%, automating ≥30% of repetitive response actions.
• Ensure Google Workspace, AWS, XDR, and MDM logs are fully integrated into SIEM by June 2026.
• Support brand protection operations by monitoring phishing, impersonation, and brand abuse activity.
• Ensure ≥70% of confirmed brand abuse cases are detected and remediated within SLAs.
• Implement automated takedown workflows to reduce customer impact by end of Q3 2026.

Qualifications

• Proven experience in Security Operations & Control Implementation.
• Hands-on experience implementing and operating security controls across endpoints, infrastructure, secure connectivity, and data protection in cloud-first environments.
• At least 3 years of experience working with XDR platforms (e.g., CrowdStrike, Cortex, Sentinel) and MDM solutions (e.g., Google Workspace, JumpCloud, or similar).
• Demonstrated ability to deploy and operate SASE / Zero Trust, VPN, and DLP solutions, including troubleshooting production control failures.

Requirements

• Experienced in operating security detections, alerts, and response workflows within SIEM and XDR platforms.
• Includes integrations with AWS, Google Workspace, and endpoint tools.
• Executes incident response actions using defined playbooks and escalates effectively based on severity and impact.
• Familiar with SOAR concepts and automation of repetitive security operations tasks to improve response efficiency.
• Proven experience deploying and managing MDM solutions to enforce endpoint security baselines at scale.
• Strong knowledge of device hardening, encryption, patching, application control, web filtering, and secure access controls.
• Ability to monitor device compliance and remediate non-compliant endpoints in a timely and efficient manner.
• Demonstrates strong operational discipline, including documentation, monitoring, alert follow-up, and incident tracking.
• Effectively manages multiple operational priorities while maintaining stability and reliability of security controls.
• Proactively identifies operational gaps and contributes to continuous improvement of security operations.
• Works effectively with IT, engineering, and infrastructure teams to deploy, operate, and improve security controls.
• Communicates incidents, operational issues, and risks clearly and concisely to both technical and non-technical stakeholders.
• Follows established processes while providing constructive feedback to improve tooling, workflows, and controls.

Benefits

• Work on a problem that truly matters—redefining how people shop, pay, and bank in Colombia.
• Be part of something big from the ground up, influencing technology, strategy, culture, and values.
• Unparalleled growth opportunity in a rapidly scaling fintech environment.
• Join a world-class team focused on excellence, ownership, and collaboration.
• Competitive compensation, including a generous salary, equity, and comprehensive benefits.

How the hiring process looks like

• Step 1: People Interview (30 min) - A conversation with a recruiter or hiring manager.
• Step 2: Initial Interview (60 min) - In-depth conversation with the Head of Cybersecurity.
• Step 3: Deep Dive Interview (60 min) - Meet future colleagues and cross-functional team members.
• Step 4: Case Study (3-5 Days) - Complete a real-world challenge or case study.
• Step 5: Co-Founder Interview - Final conversation with the Founder to align on expectations.