Senior Security Engineer

Credit Sesame is a financial wellness platform that uses technology, data-driven solutions, AI, and analytics to support financial health. The Senior Security Engineer will own platform security end to end, including security reviews, infrastructure and access security, vulnerability management, incident response, compliance controls, application security, automation, detection pipelines, and AI/LLM threat modeling.

Responsibilities:

• Run security reviews for new tools, vendors, and projects — data handling, AI usage, DPAs, PII, authentication/authorization, and third-party security reports (SOC 2, PCI, ISO, pentest results)
• Own access and infrastructure security — IAM least-privilege reviews, S3/database access controls, environment segregation, service-to-service authentication, and network configuration audits (VPC flow logs, inbound/outbound rules)
• Run vulnerability management across cloud and endpoints, and manage IDS/IPS (e.g., Palo Alto Panorama, AWS WAF) and EDR/MDR tooling
• Lead security incident response end to end — triage, investigate, contain, document, and build the runbooks as you go
• Implement and maintain the technical controls supporting our PCI DSS and SOC 2 / ISO 27001 compliance programs, including internal audits, risk metrics, and disaster recovery planning
• Partner with DevOps/IT on patch management and secure infrastructure defaults, and present tooling and risk recommendations to engineering leadership
• Build our in-house AppSec scanning program — evaluate and pilot SAST/SCA/IaC tooling (Semgrep, Trivy, Upwind), integrate into GitLab CI and Jenkins, define severity-based remediation SLAs, and drive rollout across services
• Build internal security tooling and automation — custom scripts and integrations (Python/boto3, APIs) that pull data from tools without native integrations into shared dashboards and reports
• Build and tune detection pipelines — for example, feeding traffic/bot-protection alerts (Datadome) into our log platform (ELK/Kibana) and writing rules that catch real attack patterns
• Threat-model and pentest our AI/LLM systems — scope risks like prompt injection and data exfiltration through MCP servers, coordinate external pentests where needed, and drive remediation
• Maintain security policies and practices and drive training and adoption throughout the company

Requirements:

• You have 7+ years of hands-on security engineering experience across application security, cloud security, and network/penetration testing — not just one lane
• You've driven tooling or architecture decisions independently (evaluated options, made the call, defended it to leadership)
• You're self-directed, pragmatic, and ruthless about prioritization
• You've built production automation from scratch — API integrations, custom collectors, or internal tooling — not just one-off scripts
• You have hands-on experience deploying and running OSS security tools — Burp Suite Community/OWASP ZAP, Nmap, Nuclei, Metasploit, Semgrep, Trivy, Wazuh/OSSEC, ELK/Kibana, Prowler/ScoutSuite, HashiCorp Vault, or similar
• You have solid AWS security experience
• You have working knowledge of PCI DSS, SOC 2, and ISO 27001 — enough to implement controls and support audits
• You're curious about emerging security domains and comfortable threat-modeling systems (like AI/LLM applications) that don't have an established playbook yet
• You're an excellent communicator who can translate cost/coverage tradeoffs and technical risk for both engineers and executives
• BS in Computer Science or related field, or equivalent hands-on experience
• Bonus: OSCP, GPEN, or similar certifications
• bug bounty experience
• prior experience at a startup
• experience securing LLM/AI-based systems