Lead Security Engineer

Role overview This is a founding security role at a small fintech building digital account-opening infrastructure for community banks and credit unions. As the first dedicated security hire, you will shape the security program for a regulated platform that banks depend on for customer onboarding, partnering with engineering, DevOps, auditors, and bank risk teams.

Responsibilities - Run a secure SDLC: dependency scanning, static analysis, targeted review of high-risk changes, and coordination of annual penetration tests, with coaching so engineers catch issues early - Partner with DevOps on IAM, secrets management, network architecture, logging, and detection - Set security policy, risk assessment, and roadmap, defending proportionality to auditors, bankers, and internal stakeholders - Own security questionnaires, vendor risk assessments, and customer security reviews aligned with bank third-party risk practices (often against FFIEC guidance) - Manage endpoint controls, access reviews, phishing resistance, and offboarding hygiene - Drive SOC 2 Type II end to end: control design, evidence collection, auditor management - Lead incident response planning, run tabletop exercises, and command real incidents, with fluency in bank breach-notification expectations

Requirements - 5+ years in security engineering with breadth across application security, cloud security, and compliance - Hands-on technical skills: reading code, writing scripts, configuring cloud security controls directly - Ownership or major contribution to a SOC 2 audit (or ISO 27001 or equivalent) - Experience answering enterprise or financial-institution security reviews - Strong written communication - Sound judgment about proportionality: knowing which risks matter at this scale and which controls are theater

Nice to have - Fintech or banking-vendor experience, plus familiarity with FFIEC, GLBA, or bank third-party risk management - Background as a first or early security hire - Detection engineering or SIEM experience - Familiarity with core banking integrations or handling of PII and KYC data flows

Benefits and work setup - Equity, sponsored 401K, parental leave, and fully paid health, vision, and dental insurance - Unlimited PTO, remote work stipend, lifestyle stipend, and twice-yearly company retreats - Fully remote within the US