Senior Corporate Security Engineer

• 30 days: You know every identity, device and critical SaaS app we run, and where the gaps are
• 60 days: SSO, MFA and automated offboarding are complete across the core stack, and every laptop is enrolled in MDM with EDR running
• 90 days: Core identity and SaaS configuration is managed as code, there's a working vendor review process, and the corporate security roadmap for 2027 is written and agreed

• 5+ years in corporate security, enterprise security or security-minded IT engineering, ideally at a fast-growing startup
• Deep hands-on experience with an identity provider (Okta, Entra ID, or Google Workspace as IdP), including SSO, SCIM and conditional access
• Experience running macOS fleets securely with an MDM (Jamf, Kandji, Fleet or similar) and EDR
• Automation skills: you write Python, Bash or similar against APIs to remove repetitive work
• Heavy daily use of AI tools like Claude Code, and good judgment about where they help and where they create risk
• Sound, risk-based judgment, and the ability to explain a tradeoff to an engineer, a salesperson or an executive and leave them agreeing

• Terraform or other config-as-code for identity, MDM or SaaS
• Experience at a crypto, fintech or payments company, especially one with real money at stake
• Having taken a company through SOC 2 or ISO 27001
• Incident response or SOC background
• Familiarity with blockchain analytics and transaction screening tools (Chainalysis, TRM)
• Experience supporting a team split across time zones

• Run SSO, MFA and automated provisioning (SCIM) across Google Workspace and the rest of our stack
• Build joiner/mover/leaver flows so new hires have the right access on day one and departing people lose it within minutes
• Run regular access reviews and keep admin and privileged access to a minimum

• Define and enforce macOS baselines through MDM: disk encryption, EDR, OS updates, device compliance
• Tie device health to access so an unmanaged or out-of-date laptop can't reach sensitive systems
• Address the new risks of AI agents and coding assistants running on employee machines, including what they can read, where data goes and what they're allowed to run

• Harden Slack, Notion, Google Workspace, our CRM and the rest of the stack: least privilege, external sharing and guest controls, and data protection guardrails
• Find and reduce shadow IT, and keep seats and licenses tight

• Run security reviews for new vendors and integrations, and maintain a tiered inventory of the ones we can't operate without
• Plan in advance for when a critical vendor is breached or goes down, so we're never improvising

• Make sure identity, endpoint and SaaS activity is logged and actionable
• Own corporate incidents such as phishing, account takeover and lost devices, and take part in company-wide incident response and blameless postmortems

• Own the corporate and IT controls for SOC 2 and similar frameworks, with evidence collected automatically rather than by screenshot
• Help answer enterprise customers' security questionnaires and reviews

• Shape the future of payments and programmable money
• Work with bleeding-edge tech in a domain where innovation moves fast
• Join a mission-driven team focused on access, openness, and trust
• Be a key contributor, not just a cog—your work will ship fast and matter
• Collaborate with top-tier protocols, builders, and financial infrastructure providers

Location and Work Environment This role is primarily in-person at our Midtown, NYC headquarters. We work together Monday through Thursday for fast, iterative collaboration and optional WFH Fridays to reset and recharge.