Lead Security Engineer

Prelim, New York +7

What you will do

Secure SDLC: dependency scanning, static analysis, security review of high-risk changes, and coordinating annual penetration tests. Teach engineers to catch issues before you have to.
Partner with DevOps on IAM, secrets management, network architecture, logging, and detection.
Policies, risk assessment, and roadmap. Decide what a company our size and risk profile actually needs, and defend that reasoning to auditors, bankers, and internally.
Own security questionnaires, vendor risk assessments, and customer security reviews. Banks conduct rigorous third-party risk management (often against FFIEC guidance).
Endpoint management, access reviews, phishing resistance, offboarding hygiene. The unglamorous stuff that questionnaires ask about first.
Own SOC 2 Type II end to end: control design, evidence collection, auditor management.
Owning incident response, from writing the plan, to running the tabletops, and leading if it's ever real. Banks have breach-notification expectations in their contracts. You'll know them cold.

Prelim, New York +7

Secure SDLC: dependency scanning, static analysis, security review of high-risk changes, and coordinating annual penetration tests. Teach engineers to catch issues before you have to.
Partner with DevOps on IAM, secrets management, network architecture, logging, and detection.
Policies, risk assessment, and roadmap. Decide what a company our size and risk profile actually needs, and defend that reasoning to auditors, bankers, and internally.
Own security questionnaires, vendor risk assessments, and customer security reviews. Banks conduct rigorous third-party risk management (often against FFIEC guidance).
Endpoint management, access reviews, phishing resistance, offboarding hygiene. The unglamorous stuff that questionnaires ask about first.
Own SOC 2 Type II end to end: control design, evidence collection, auditor management.
Owning incident response, from writing the plan, to running the tabletops, and leading if it's ever real. Banks have breach-notification expectations in their contracts. You'll know them cold.