Senior Security Engineer, AI-Driven Detection & Response

About Us:

Monarch is a powerful, all-in-one personal finance platform designed to help make the complexity of finances feel simple again. Since launching in 2021, we’ve become the top-recommended personal finance app by users and experts. Our goal? To take the stress out of finances so our members can focus on what truly matters.

We are a team of do-ers led by experienced entrepreneurs who are passionate about helping our members reach their financial goals. We are hyper focused on building a product people love and continuing to evolve based on user feedback.

As a fully remote company (even before COVID!), we welcome applicants from almost anywhere. Our team collaborates synchronously mostly from 9 AM – 2 PM PT and embraces asynchronous work to stay connected across time zones.

Join us on our mission to transform lives by simplifying money, together.

The Role:

Monarch is hiring a Senior Security Engineer, Detection and Response to join our Security team within Foundations — the first dedicated hire for this function. Reporting to the TLM of the Corporate & Infrastructure Security squad, you will build detection, automation, and response capabilities while working with IT to harden the tools people use every day.

What makes this role different is the AI mandate. Monarch is genuinely AI-first, and we expect you to bring that mindset to the security engineering team — using LLM-augmented workflows to accelerate detection authoring, automate phishing triage, analyze logs, and build internal tooling. You'll also be responsible for governing the enterprise AI platforms themselves (e.g. Claude, OpenAI) as corporate security surfaces.

If you've been waiting for a security role where AI fluency isn't a nice-to-have but a core expectation, this is it.

You'll join a lean, senior security team that has strong foundations already in place — SOC 2 Type 2 complete, best in-class tooling — and you'll build the next layer of security maturity on top of that. This is a opportunity to help define how security engineering works at a fast-growing fintech protecting real financial data for hundreds of thousands of users.

What You'll Do:

• Build a detection engineering program and supporting infrastructure

• Author and maintain detections and build alerting pipelines that feed triage and incident response

• Investigate and respond to security incidents

• Drive security configuration and policy for enterprise AI platforms (Claude Enterprise, OpenAI)

• Use AI daily to transform how detection, response and corporate security operates — building LLM-augmented workflows for detection, triage, automation, and internal tooling

• Partner with IT to harden SaaS platforms and endpoints (Iru/Kandji MDM, Crowd Strike Falcon EDR)

• Mature DLP program covering SaaS, email, endpoints, and AI prompt exfiltration paths

What You'll Bring:

• 5+ years in security engineering with demonstrated depth in detection & incident response and corporate security, using SIEM and in collaboration with MDR providers

• Detection engineering and incident response experience — ability to build and maintain detection infrastructure, workflows, author detections, triage alerts, and run security incidents end-to-end

• Hands-on experience administering enterprise AI platform controls (Claude Enterprise or OpenAI Enterprise admin — SSO/SCIM, audit logging, managed settings, usage governance)

• Hands-on experience securing SaaS and working with Iru (Kandji) or equivalent MDM and Okta workforce identity — understanding security hardening, device trust, and IAM policy even if not the primary administrator

• Integrated AI fluency — actively uses AI tools to accelerate security work, build automation, and ship internal tooling

Nice to Haves:

• Cloudflare Zero Trust / ZTNA experience (Access, Gateway, WARP, Tunnel)

• DLP program experience (Cyberhaven, Nightfall, or similar)

• SaaS security posture tooling experience (Nudge Security, Push Security, or similar)

• Fintech or financial services background

• Relevant certifications: CISSP, CCSP, GCFA, Crowd Strike certifications

Typical Process:

• Recruiter Video Call

• Hiring Manager Video Call

• Technical Assessment

• Virtual "onsite" round consisting of 2-4 technical and…