Senior Software Engineer, Security Platform

• Design, build, and operate security engineering services primarily in Golang and Python on AWS and Kubernetes
• Maintain, harden, and retire existing security services
• Own the NATS event-driven platform, including contracts, consumers, delivery guarantees, and observability
• Integrate scanners, finding system of record, tickets, and metrics
• Own SAST, SCA, secret detection, container, and IaC security gates from tuning through enforcement
• Build CI review agents, automated finding triage and verification, and remediation helpers
• Automate triage-to-remediation workflows, including reproduction context, fix guidance, and routing
• Participate in threat modeling and secure design reviews
• Participate in the on-call rotation
• Report to the Director of Information Security and collaborate with detection and response and network and zero trust engineers

• 6+ years of professional software engineering experience, including significant backend experience
• Deployed significant changes to a production application in the past 30 days
• Strong proficiency in Golang, plus working proficiency in Python
• Hands-on experience building and operating event-driven or message-based systems (NATS, Kafka, or similar), including contracts, idempotent consumers, replay, and back-pressure
• Hands-on experience building and operating CI/CD pipeline tooling; GitLab CI at fleet scale is a strong plus
• Hands-on web application security knowledge, including the OWASP Top 10 in real code
• Hands-on experience with SAST, SCA, and secret-scanning tooling, including tuning for acceptable signal-to-noise ratio
• Demonstrated AI-forward engineering experience using AI tooling and building agentic workflows adopted by other engineers
• Working knowledge of AWS and Kubernetes as deployment targets
• Preferred: experience in fintech, payments, BNPL, or consumer lending
• Preferred: working knowledge of PCI DSS and SOC 2
• Preferred: software supply-chain integrity experience, including SBOM pipelines, dependency governance, artifact signing and provenance
• Preferred: familiarity with policy-as-code and admission control
• Preferred: exposure to bug bounty or external vulnerability report triage
• Preferred: experience with system-level threat modeling