Senior Software Engineer, Security Platform

• Design, build, and operate security engineering services primarily in Golang and Python on AWS and Kubernetes
• Maintain, harden, and retire existing security services
• Own the NATS-based event-driven platform, including contracts, consumers, delivery guarantees, and observability
• Integrate scanners, finding system of record, tickets, and metrics
• Own security gates for SAST, SCA, secret detection, container, and IaC scanning
• Tune scanners, manage suppression workflows, reduce false positives, and roll out enforcing security gates
• Build CI review agents, automated finding triage and verification, and remediation helpers
• Automate triage-to-remediation workflows, including reproduction context, fix guidance, and routing
• Participate in threat modeling and secure design reviews
• Participate in the on-call rotation for owned services
• Report to the Director of Information Security and collaborate with detection and response, network, and zero trust engineers
• Build reusable AI-assisted engineering workflows and maintain review discipline in platform code

• 6+ years of professional software engineering experience, including significant backend experience
• Deployed significant changes to a production application in the past 30 days
• Strong proficiency in Golang, plus working proficiency in Python
• Hands-on experience building and operating event-driven or message-based systems (NATS, Kafka, or similar), including contracts, idempotent consumers, replay, and back-pressure
• Hands-on experience building and operating CI/CD pipeline tooling; GitLab CI at fleet scale is a strong plus
• Hands-on web application security knowledge, including the OWASP Top 10 in real code
• Hands-on experience with SAST, SCA, and secret-scanning tooling, including tuning signal-to-noise ratio
• Demonstrated AI-forward engineering experience using AI tooling and building agentic workflows adopted by other engineers
• Working knowledge of AWS and Kubernetes as deployment targets
• Preferred: experience in fintech, payments, BNPL, or consumer lending
• Preferred: working knowledge of PCI DSS and SOC 2
• Preferred: software supply-chain integrity, including SBOM pipelines, dependency governance, artifact signing, and provenance
• Preferred: familiarity with policy-as-code and admission control
• Preferred: exposure to bug bounty or external vulnerability report triage
• Preferred: experience with system-level threat modeling