Senior Software Engineer, Security Platform

• Design, build, and operate security engineering services primarily in Golang and Python on AWS and Kubernetes
• Maintain, harden, and retire existing services
• Own the NATS-based event-driven platform, including contracts, consumers, delivery guarantees, and observability
• Integrate scanners, finding systems of record, tickets, and metrics
• Own security gates for SAST, SCA, secret detection, container scanning, and IaC scanning
• Select and tune scanners, manage suppression workflows, reduce false positives, and roll out enforcing gates
• Build CI review agents, automated finding triage and verification, and remediation helpers
• Automate triage-to-remediation workflows, including reproduction context, fix guidance, and routing
• Participate in threat modeling and secure design reviews
• Participate in the on-call rotation
• Report to the Director of Information Security and collaborate with detection and response and network and zero trust engineers

• 6+ years of professional software engineering experience, including significant backend experience
• Deployed significant changes to a production application in the past 30 days
• Strong proficiency in Golang and working proficiency in Python
• Hands-on experience building and operating event-driven or message-based systems, including contracts, idempotent consumers, replay, and back-pressure
• Hands-on experience building and operating CI/CD pipeline tooling; GitLab CI at fleet scale is a strong plus
• Hands-on web application security knowledge, including the OWASP Top 10 in real code
• Hands-on experience with SAST, SCA, and secret-scanning tooling, such as Semgrep, CodeQL, Snyk, Trivy, Grype, and gitleaks
• Demonstrated AI-forward engineering using AI tooling and building agentic workflows adopted by other engineers
• Working knowledge of AWS and Kubernetes
• Preferred: experience in fintech, payments, BNPL, or consumer lending
• Preferred: working knowledge of PCI DSS and SOC 2
• Preferred: software supply-chain integrity, including SBOM pipelines, dependency governance, artifact signing, and provenance
• Preferred: familiarity with policy-as-code and admission control, such as OPA, Kyverno, and conftest
• Preferred: exposure to bug bounty or external vulnerability report triage
• Preferred: experience with system-level threat modeling