Senior Security Engineer

Casca, San Francisco

What you will do

Software. Detections, libraries, policy-as-code, automation, CI/CD checks — reviewed, tested, and deployed like any other service.
Design reviews and threat models on what actually matters: auth, tenant isolation, data handling, anything touching borrower PII.
The AI attack surface. Prompt injection, tool-use abuse, exfiltration paths through agents, and the evals that tell you whether your controls hold.
Incidents, end to end, including the write-up and the fixes that follow.
Bank security reviews and audits, turned into engineering work that improves the system rather than paperwork that describes it.

Casca, San Francisco

Software. Detections, libraries, policy-as-code, automation, CI/CD checks — reviewed, tested, and deployed like any other service.
Design reviews and threat models on what actually matters: auth, tenant isolation, data handling, anything touching borrower PII.
The AI attack surface. Prompt injection, tool-use abuse, exfiltration paths through agents, and the evals that tell you whether your controls hold.
Incidents, end to end, including the write-up and the fixes that follow.
Bank security reviews and audits, turned into engineering work that improves the system rather than paperwork that describes it.