Security Engineer

Responsibilities

• Own the security model for partner-facing APIs, including authentication, authorization, tenant isolation, and audit logging
• Drive a coherent auth strategy across services, including step-up auth and passkeys
• Build device telemetry, behavioral signals, and velocity primitives for fraud and risk functions
• Partner with Engineering on secure-by-design practices, architecture reviews, and threat modeling
• Own the secure SDLC, including SAST/DAST, dependency scanning, and secret detection
• Coordinate with infrastructure teams to improve security posture across the stack and supply chain
• Lead incident response, including containment, forensics, and blameless postmortems
• Translate compliance frameworks like SOC 2 and PCI DSS into scalable engineering solutions

Requirements

• Strong programming skills in Java, Python, or comparable languages
• Experience designing or operating secure B2B APIs at scale in multi-tenant environments
• Background in anti-ATO, anti-fraud, or authentication systems at scale
• Working knowledge of AWS (IAM, KMS, networking, service-to-service auth)
• Proficiency with modern AI tooling for code review and threat modeling
• Excellent written communication skills for threat models and postmortems

Preferred Qualifications

• Experience in fintech, payments, or other regulated environments
• Background in threat modeling methodologies like STRIDE
• Experience building for risk or fraud operations teams
• Experience operating bug bounty or vulnerability disclosure programs

Benefits

• Meaningful start-up equity
• 100% health, vision & dental primary coverage
• 75% health, vision & dental dependent coverage
• Catered lunches and dinners
• $250/month commuter benefit
• Parental leave
• Team building events
• Flexible PTO (minimum 15 days)
• 401(k) plan
• Relocation assistance

About the Company

Cardless provides the infrastructure that allows consumer brands to embed credit cards directly into their own products, handling everything from applications to compliance.