Staff Security Engineer

Cari Network is building a blockchain-based payment system for real-time movement of digital money. The Staff Security Engineer will build and lead the security program, protecting identity, cloud, detection, blockchain infrastructure, and payment operations while driving incident response and compliance readiness.

Responsibilities:

• Own identity end to end. Roll out SSO and automated joiner-mover-leaver lifecycle management across corporate and production systems. Design the role and entitlement model, run periodic access reviews, and make least privilege the default
• Secure blockchain and signing infrastructure. Partner with engineering to threat-model and harden our Solidity smart contracts, private ZKsync L2 nodes, and custody platform integrations. Define upgrade governance for on-chain systems
• Build detection from the ground up. Deploy and own our SIEM, onboarding and normalizing logs across cloud, identity, endpoint, and application layers. Build high-signal detections for authentication abuse, control plane activity, privilege escalation, data movement, and anomalous transactions. You own alert quality, not alert volume
• Lead incident response. Serve as technical lead for alerting, vulnerability management, and threat response. Write containment runbooks, drive investigations through postmortem, and feed lessons back into detection
• Harden AWS. Enforce least-privilege IAM, network segmentation, and secrets management across ECS/EKS, MSK, and RDS
• Make security part of shipping. Build automated security gates into CD pipelines and developer workflows, so security keeps pace with delivery
• Drive compliance readiness. Work with the CISO to implement and document controls for bank-level governance, third-party risk, and audits such as SOC 2 Type II
• Comply with all Cari information security policies, including the Acceptable Use Policy, and complete required security awareness training
• Protect the confidentiality, integrity, and availability of Cari systems and data, including bank-partner and customer information, consistent with least-privilege access principles

Requirements:

• 8+ years in information security, DevSecOps, or infrastructure security
• Deep ownership of at least two of these areas, with hands-on experience in the third:
• Enterprise IAM: SSO, federation, automated provisioning and deprovisioning, role and entitlement design, and access reviews
• SIEM and detection: deployment, tuning, log onboarding, and detection authoring. You can point to detections you've written and explain how you kept them useful
• AWS security: ECS or EKS, MSK, RDS, IAM, VPC, and Secrets Manager
• Experience securing EVM-compatible blockchain or Web3 infrastructure
• Experience securing CD pipelines (GitHub Actions or equivalent) and containerized workloads
• Incident response leadership
• Comfort working with high autonomy on a small team building a security program from scratch
• Solidity smart contract reviews, including upgradeable proxies (such as UUPS) and role governance
• Defensive knowledge of L2s, cross-chain bridges, ZK rollups, and EVM transaction mechanics (ABI encoding, calldata validation, nonce management, event log integrity)
• Key management, custody APIs (Fireblocks, Turnkey, Fordefi), MPC signing, or real-time Web3 threat detection and transaction circuit breakers
• Detection-as-code: version-controlled, tested detections mapped to a framework
• Terraform, including auditing environments and codifying secure baselines
• U.S. banking regulation (FFIEC), or SOC 2 Type II and ISO 27001 audits