IT & Information Security Lead

About Us
Draftea is the sports entertainment company built for the Latin American fan. Through our two brands: Draftea in Mexico and Pitaco in Brazil, we build products that bring fans closer to the sports they love across the entire region.

We are a technology company, with teams across Latin America. Backed by world-class investors including Sequoia, Kaszek, Paradigm and Bullpen Capital, and trusted by sports organizations including the NFLPA and athletes including Cristiano Ronaldo, Kevin Durant, Travis Kelce, Iker Casillas, Pau Gasol, Odell Beckham Jr., and Cesar Azpilicueta.

Our Culture
We build a product made to entertain our users, so we keep a workplace where we work hard and have a good time doing it, surrounded by people who are just as motivated and just as sharp. We believe in flexible hours and we care about results, which is why we're looking for someone who's genuinely into the product, the role and the challenge, not just after another 9-to-5.

We're a remote-first company. We have offices in Mexico City and Buenos Aires, but our team works from all over (México, Brazil, Peru, Colombia, Chile, Uruguay, Argentina, the Dominican Republic and the United States).

About the role
As IT & Information Security Lead at Draftea, you'll own both IT operations and information security end-to-end — from day-to-day execution to setting the long-term strategy. In this role, you will lead and manage a small team of 2 people while staying comfortably hands-on. You will be responsible for defining and driving our IT baseline (MDM, SaaS/software stack, IAM, vendor management, and onboarding/offboarding) while ensuring robust security operations, compliance, and regulatory readiness across the company. The goal is straightforward: keep IT and security moving seamlessly at the speed of the business, enabling our teams to move faster without compromising protection or compliance.

What you'll take on
IT & System Ownership: own and oversee core IT operations, including endpoint fleet management (MDM), SaaS/software inventory, IAM, onboarding and offboarding workflows, and vendor security/procurement management, guiding the team on daily execution.

Team Leadership: manage and mentor a team of 2 people, taking full ownership of the IT and Security function while balancing team management with hands-on technical work.

Identity & Access Management: run and mature identity management across all tools (provisioning, group structures, permissions, and least privilege enforcement).

Endpoint Security & MDM: keep the full device fleet enrolled, managed, and fully compliant with solid operational baselines.

Compliance, Regulatory & Audits: lead regulatory readiness, compliance frameworks (ISO 27001, CIS, and market-required certifications), and manage audits and certifications end-to-end.

Security Operations: drive hands-on security operations while maintaining the strategic vision and governance of the function.

Application & Cloud Security: maintain a strong working knowledge of application and cloud security, enforcing SSO/SAML, MFA, access control, and sensible cloud baselines.

Vendor Management: evaluate and monitor third-party tools and vendors to keep their security posture and access controls aligned with company standards.

Security Culture & Business Alignment: foster strong security and IT habits across the company, ensuring security acts as an enabler rather than a bottleneck.

Requirements
Function Ownership & Team Management: proven track record of owning IT & Security operations and managing a small team (or directly mentoring technical peers).

IT Ownership & Operations: deep experience managing IT foundations — MDM, SaaS application management, Identity and Access Management (IAM), onboarding/offboarding processes, and IT vendor management.

Security Operations & Compliance: strong operational background in security baseline enforcement, ISO 27001, CIS Benchmarks, and leading regulatory audits and certifications end-to-end.

Regulated Industry Experience: strong experience working in regulated or high-growth environments where compliance, audits, and formal certifications are business-critical.

Working Knowledge of Cloud/App Security: solid working understanding of cloud environments (AWS/GCP), application security configurations, SSO/SAML, and MFA enforcement.

Hands-on & Strategic: equally comfortable executing hands-on technical/operational tasks and defining team strategy, processes, and policies.

Startup Pace & Autonomy: comfortable thriving in a fast-paced startup/scale-up environment with high autonomy and proactiveness.

Nice to have
Certifications such as CompTIA, ISO 27001 Lead Implementer/Auditor, CISSP, CISM, or cloud security certifications (AWS/GCP).

Professional proficiency in English, Spanish and Portuguese.

Experience in regulated or high-growth industries.