Senior Security Engineer (AWS, Terraform, Python) | Up to $235K USD + Equity

“Unfortunately, no one can be told what secure by design is. You have to build it yourself.” Morpheus, if he had run AppSec instead of the Nebuchadnezzar

This is your last chance. After this, there is no turning back. You take the blue pill and you stay in a big company security team, writing policies nobody reads and blocking releases nobody thanks you for. You take the red pill and you build the security foundation for a fast scaling fintech from the ground up, at the exact moment it matters most.

We are offering the red pill.

The company

Our client is a Series B, New York based company at the intersection of consumer finance and applied AI. They have built a platform that uses data and AI to fix a large, old and famously clunky corner of financial services, in a way that works better for the businesses using it and for the everyday people on the other end of it.

Tens of billions of dollars have moved through the platform, more than twenty million consumers have interacted with it, and well known consumer finance brands are customers who stay and expand. Around a hundred people in downtown Manhattan, now growing from one product into a multi product platform. We can share more once we speak.

The role

The company has earned the hard fought trust of leading financial institutions. Your job is to build the security foundation that scales that trust to tens of millions of consumers, in an industry where trust is profoundly broken.

You will architect dual trust. Consumer facing experiences on one side, bank grade enterprise systems on the other, and technical problems in the middle that exist almost nowhere else: privacy preserving data systems, multi jurisdiction compliance automation and AI enabled decisioning. You will shape security strategy and culture from the ground up, with direct influence on where the company goes, and you will prove that security is not overhead. It is the competitive moat that unlocks enterprise partnerships and opens new markets.

The Matrix has agents. So does this company, and they make decisions about real people’s money. Someone has to make sure they are the good kind.

What you will actually do

You will turn security into a competitive advantage. Not a compliance checkbox banks tolerate, but product capabilities banks choose the company for, the kind that unlock Tier 1 partnerships and enterprise deals competitors cannot close.

You will drive security by design across product and application development, working with product and engineering to find and fix critical risks before production, with deep focus on application security across the frontend, Flask services and the database. You will embed security into discovery and design, build secure by default patterns into development workflows, and accelerate the team through early engagement and clear guidance rather than late stage gatekeeping. There is no spoon. There is no ticket queue where good ideas go to die either.

You will architect bank grade data protection: data classification, encryption and access control that meets regulated client requirements, with automated controls ensuring sensitive data never leaves authorised boundaries. You will build a security first engineering culture, leading incident response with clarity and urgency and running the post mortems that make the company stronger. Deja vu in the codebase means something changed. You will be the one who notices.

And you will scale compliance with minimal overhead, maintaining SOC 2, PCI DSS and financial compliance through automated systems and infrastructure that generates its own audit evidence, so compliance stops being a bottleneck.

What we are looking for

You have five or more years in security engineering, ideally in cloud native or fintech environments. You have personally built application level security controls in cloud environments, hands on in AWS, Terraform and Snowflake, not audited them, advised on them or program managed them. You have a track record of security that accelerates velocity rather than blocking it. Your technical depth covers secure coding in Python and JavaScript, infrastructure as code and CI/CD security, and you know OWASP, secure coding practice and common vulnerability patterns cold. Scripting in Python, JavaScript and Bash is strongly preferred.

If your background is big company security where the work was policy, review boards and telling engineers no, this will not be the right fit. T…