JOB-1380
Our client is a financial-technology startup that stores highly sensitive customer records, and it wants a seasoned engineer to keep the product safe while the team keeps moving quickly. The job is hands-on engineering aimed at security: you would contribute to the actual application and platform repositories, create tools and safer defaults, and remove whole categories of bugs before they reach production. It is not a paperwork, audit-coordination or scanner-babysitting job.
Day-to-day
- Create shared code, templates and defaults so that doing the secure thing is also the effortless thing for other developers
- Critique architecture proposals and code changes with an eye on login and permissions logic, customer-data separation, credential handling, exposure of private data and misuse
- Model threats for upcoming features and third-party connections in a practical, time-boxed way
- Tune build pipelines and developer workflows so that real findings appear early and noise stays low
- Pair with application and infrastructure engineers on durable fixes instead of patching one ticket at a time
- Help define a lean approach to secure software delivery suited to a small company, and take part in post-incident reviews
Who thrives here
- Eight-plus years in senior engineering roles with a security specialty, or a software developer who crossed into security and still writes production code
- Fluent enough in TypeScript and Node to read and modify the codebase confidently
- Strong AWS security knowledge, plus the ability to review Terraform-style infrastructure code
- Background at a respected software company or security vendor
- Writes clearly: risk write-ups, runbooks, short decision notes
- Enjoys small-team settings, wide ownership and practical trade-offs
Fully remote across the US. Compensation depends on seniority.
