Open to opportunities

Diego User

@diegouser12

Message

Security engineering director specializing in application, cloud, and AI security for regulated products.

Spain

Message

What I'm looking for

I’m looking to lead security engineering that embeds controls into CI/CD, strengthens Secure SDLC and threat modeling, and makes AI-assisted security reliable—while partnering closely with product, SRE, and compliance in regulated environments.

I’m a security engineering leader spanning application, cloud, and AI security, with experience delivering compliance-heavy programs across fintech, SaaS, and financial services. As Director of Security Engineering at Flywire (Spain, Remote), I lead a 15+ person team and align security execution to business priorities while reporting to the CISO.

I build security programs that embed controls into CI/CD and developer workflows—integrating SAST, DAST, SCA, and penetration testing to enable developer-led remediation at scale. I also helped make AI security practical early: I set up guardrails and oversight controls, redesigned the Secure SDLC with AI-driven automation to reduce security review cycles from days to hours, and implemented an AI-built threat modeling process using STRIDE and MAESTRO.

Experience

Work history, roles, and key accomplishments

Current

Director of Security Engineering

Current

Flywire

Feb 2024 - Present (2 years 5 months)

Led security engineering across application, cloud, and AI security for regulated B2B, healthcare, education, and travel products, reporting to the CISO and aligning security execution to business priorities. Managed a 15+ person security engineering team and drove security roadmap, executive reporting, and auditor/regulator relationships across PCI-DSS 4.0, ISO 27001, SOC 2, and NIST CSF 2.0.

Product Security Engineering Manager

Salesforce (incl. MuleSoft & Heroku)

Jan 2019 - May 2023 (4 years 4 months)

Led product security strategy and execution across Heroku PaaS and Salesforce product lines, including SDB, Apex, and Core. Established SDLC security review intake, security metrics, and threat modeling adoption, and led security disclosures and remediation guidance for security findings.

Product Security Heroku CVE 2021 1630 XXE Vulnerability Security Metrics KPIs Threat Modeling Threat Canvas Mentoring

Senior Security Operations Manager

Base4 Security

Jan 2015 - Jan 2019 (4 years)

Led offensive and defensive security teams across 200+ penetration testing and red team engagements for clients across financial services, telecommunications, retail, and technology sectors. Directed Telefónica Argentina’s security hardening initiative and delivered training programs covering incident handling and secure development lifecycle management.

Penetration Testing Red Teaming Offensive Security Defensive Security Security Hardening Training Delivery

Head of Security Controls

Itaú Bank

Jun 2013 - Oct 2015 (2 years 4 months)

Managed access governance for 5,000+ users and delivered monthly security KPIs and dashboards to the executive committee. Directed security incident detection and response using SIEM and GRC platforms and led BCRA-regulated audit engagements, while defining and enforcing security policies and controls for new business projects.

Access Governance SIEM GRC Platforms Incident Response BCRA Compliance Security Policies

Head of Security

DineroMail

Jan 2011 - Jun 2013 (2 years 5 months)

Built the information security function from scratch across five Latin American countries as founding security leader. Led PCI-DSS certification across regional entities and deployed a SIEM platform with automated event correlation to provide centralized security visibility.

Information Security Leadership PCI DSS SIEM Security Visibility Payment Security

Senior Information Security Analyst

Western Union – Pago Fácil

May 2009 - Jan 2011 (1 year 8 months)

Managed role-based access controls and segregation of duties across company systems. Collaborated with infrastructure teams to enforce baseline hardening configurations across servers, workstations, and network devices.

Role Based Access Control (RBAC)Security Hardening Access Control Baseline Hardening Infrastructure Security

Information Security Analyst

ESET Argentina

Jan 2006 - Apr 2009 (3 years 3 months)

Performed malware analysis and reverse engineering to assess threat behavior and inform product development. Delivered ethical hacking and offensive security assessments and conducted BCRA-regulated compliance audits for Argentine financial institutions.

Malware Analysis Reverse Engineering Ethical Hacking BCRA Compliance Audits

Information Systems Auditor

PKF

Jan 2005 - Jan 2006 (1 year)

Executed IT security and compliance audits for regulated industries and prepared formal findings reports for internal, external, and BCRA regulatory stakeholders.

IT Security Audits Compliance Audits Audit Reporting