Founding Security Engineer

Description

The company began by offering corporate cards and bank accounts to creators, the people on YouTube, Instagram, TikTok and Twitch who run real businesses that many financial providers overlooked. The same products suit a wider range of businesses, so it now also serves agencies, studios and fast-growing firms run in a similar way.

Investors include Signal Fire, Union Square Ventures, Y Combinator, CRV and Coatue, who have put in $70 million. Backers also include CEOs from YouTube, Twitter and Wealthfront, and Twitch co-founder Kevin Lin. The team comes from Goldman Sachs, McKinsey, earlier startups and the creator world, and is based in Los Angeles.

The company holds customer funds and financial data, so the compliance and security duties of a banking program sit with it directly. Protecting that well without slowing a small team that ships quickly is the core of this role.

This is the first dedicated security engineer hire. Security currently falls to whichever engineers and operators are closest to each system. You will turn it into a formal program covering the cloud infrastructure and edge behind banking, charge card and payments products, the delivery pipeline, employee laptops and SaaS, and the SOC 2 and bank partner evidence that shows the controls work.

This is hands-on engineering, not advisory work. You will write infrastructure as code and application code, deploy and run what you build, and review pull requests that touch auth, money movement and customer data. You will also explain the controls to bank partners and auditors, since you built them.

The team is lean, ships fast and uses AI tooling heavily. The best fit cares as much about not slowing people down as about tightening access, and measures the friction any new control creates.

Creators, agencies, studios and growing companies are a large market that most financial providers still treat as an edge case. The products already exist and are now being scaled. Work includes card issuance, payouts, KYC, and the fraud and compliance work that comes with holding deposits.

There is no security organisation to inherit and no legacy controls to untangle, so the patterns you choose in your first year will be among the first the company runs on. The team is small, hands-on, and includes former founders, banking and payments operators, and engineers from top companies. Everyone is expected to own their work, get things done and improve what exists rather than maintain it. The company is well funded, keeps the team lean, and offers room to grow as it scales.

Responsibilities

• Run the cloud security baseline: least-privilege IAM, network segmentation, secrets handling, WAF and edge rules, logging, backups and infrastructure as code.
• Make shipping safe: control source access, CI/CD pipelines, dependency and secret scanning, separate environments, and production access that leaves an audit trail without adding pain.
• Secure corporate and endpoint systems: SSO and identity, OAuth scope and sharing reviews, automated device onboarding and offboarding, phishing-resistant MFA with hardware keys and passkeys, and an enforced laptop baseline rolled out in stages.
• Handle the technical side of SOC 2 and bank partner due diligence: controls as code, self-collecting evidence, network and data-flow diagrams, pen test coordination, vendor security reviews and partner questionnaires.
• Build detection and response: centralise logs, write alerts for fintech risks such as account takeover, privileged access and unusual money movement, write runbooks, and be the first responder when something looks wrong.
• Work with product engineers on application security: threat-model features such as payouts, card issuance and KYC flows, review risky PRs, and ship customer-facing protections like passkeys and session hardening.
• Define safe use of AI agents and tools: what they may access, what gets logged, and where customer data may and may not go.
• Track threats hitting other fintechs, including account takeover rings, support-desk social engineering and supply-chain compromises, and turn them into changes each quarter.
• Design controls people will actually use. When engineers or operations staff work around one, treat it as a flaw in the control.

Requirements

• 6+ years of experience in infrastructure, DevOps, platform or security engineering, or 5+ years including building and running production systems on a major cloud provider.
• Has been on call for something that mattered.
• Writes code and ships it: infrastructure as code (Terraform, Pulumi or similar) and fluency in at least one of TypeScript, Python or Go. You will be asked to show something you built.
• Practical experience with corporate IT: a productivity suite such as Google Workspace or Microsoft 365, an MDM, an identity provider and hardware security keys, rolled out to real users and the support load that follows.
• Has built or run the technical side of a SOC 2, PCI or bank partner audit at a company without a compliance team.
• Has started something, or was among the first 20 people somewhere and owned a function no one else would. Comfortable deciding what matters without direction.
• Has worked at a bank, fintech, payments company or other regulated environment, or has a strong interest in finance, and understands why bank partners ask what they ask.
• Has chosen not to ship a control because the friction outweighed the risk reduction, and can describe that decision.
• Follows the field closely: can discuss recent fintech incidents and what they would have done differently, with views on passkeys, device trust and securing AI agents.
• Writes clearly, since auditors, bank partners and teammates will read it and much of the influence comes through writing.
• Edge security depth: WAF, zero trust access and DNS.
• Detection engineering: has built alerting from raw logs without a large SIEM budget.
• Has shipped WebAuthn or passkey support in a product.
• Has sat on the company side of a BaaS or sponsor bank audit.
• Has built security controls for LLM tooling or agents: access scoping, logging and data handling.
• Public work such as open source, writeups, talks or a bug bounty profile.

Conditions

Based in Los Angeles, or willing to relocate there. Remote is considered for the right candidate.

Visa: US citizen/visa only.