Lead Security Engineer

Role overview

This is a founding security role at a small fintech building digital account-opening infrastructure for community banks and credit unions. As the first dedicated security hire, you will shape the security program for a regulated platform that banks depend on for customer onboarding, partnering with engineering, Dev Ops, auditors, and bank risk teams.

• Run a secure SDLC: dependency scanning, static analysis, targeted review of high-risk changes, and coordination of annual penetration tests, with coaching so engineers catch issues early
• Partner with Dev Ops on IAM, secrets management, network architecture, logging, and detection
• Set security policy, risk assessment, and roadmap, defending proportionality to auditors, bankers, and internal stakeholders
• Own security questionnaires, vendor risk assessments, and customer security reviews aligned with bank third-party risk practices (often against FFIEC guidance)
• Manage endpoint controls, access reviews, phishing resistance, and offboarding hygiene
• Drive SOC 2 Type II end to end: control design, evidence collection, auditor management
• Lead incident response planning, run tabletop exercises, and command real incidents, with fluency in bank breach-notification expectations

• 5+ years in security engineering with breadth across application security, cloud security, and compliance
• Hands‑on technical skills: reading code, writing scripts, configuring cloud security controls directly
• Ownership or major contribution to a SOC 2 audit (or ISO 27001 or equivalent)
• Experience answering enterprise or financial‑institution security reviews
• Strong written communication
• Sound judgment about proportionality: knowing which risks matter at this scale and which controls are theater

• Fintech or banking‑vendor experience, plus familiarity with FFIEC, GLBA, or bank third‑party risk management
• Background as a first or early security hire
• Detection engineering or SIEM experience
• Familiarity with core banking integrations or handling of PII and KYC data flows

• Equity, sponsored 401K, parental leave, and fully paid health, vision, and dental insurance
• Unlimited PTO, remote work stipend, lifestyle stipend, and twice-yearly company retreats
• Fully remote within the US