Security Engineer - Product

About this role

Lead product security for Cardless' infrastructure platform powering embedded credit programs for major brands like Coinbase and Bilt. You'll own authentication, fraud prevention, API security, and secure-by-design practices across a fintech platform handling sensitive payment data, working cross-functionally with engineering, risk, and compliance teams.

What you'll do

• Design and maintain security models for partner-facing APIs including authentication, authorization, tenant isolation, and audit logging
• Develop authentication strategy across services with step-up auth and modern approaches like passkeys
• Build device telemetry and behavioral signal systems for fraud and risk detection
• Partner with engineering on secure architecture reviews, threat modeling, and design tradeoffs before features ship
• Manage secure SDLC tooling including SAST/DAST, dependency scanning, and secret detection
• Lead security incident response, forensics, and coordinate vulnerability remediation across services

What they're looking for

• Production programming in Java, Python, or similar languages
• Secure B2B API and multi-tenant platform design at scale
• Anti-ATO, anti-fraud, and authentication systems experience
• AWS security (IAM, KMS, networking, service-to-service auth)
• Threat modeling methodologies (STRIDE or equivalent)
• AI tooling proficiency for code review and detection engineering
• Technical writing for threat models and security documentation
• Incident response and postmortem leadership

Benefits

• Meaningful startup equity
• 100% coverage for health, vision, and dental; 75% for dependents
• Catered lunches and dinners
• $250/month commuter benefit
• Parental leave and flexible PTO with minimum 15 days annually
• 401(k) plan