Security Engineering Manager

Blend is a cloud banking platform company helping financial services firms acquire customers, increase productivity, and deliver end-to-end digital experiences. The Security Engineering Manager will lead the security engineering team, own its roadmap and technical execution, direct red teaming and adversarial testing, and embed security throughout the software development lifecycle. The role also involves hands-on development of security frameworks and tooling and defining security approaches for AI-enabled features and systems.

Responsibilities:

• Own the day-to-day operations of a team dedicated to the security of our product, platform, and overall software development lifecycle
• Manage and help shape the security engineering team's roadmap, its overall hiring and expansion, and its overall technical execution
• Orchestrate our red teaming capabilities and ensure we incorporate adversarial testing into our development pipeline
• Growing and directing the team through active and empathetic coaching
• Focus on deep, technical work in order to help ship impactful security frameworks, methods, and tooling across the organization
• Partner closely with the rest of the security team, as well as the broader product, platform, and infrastructure teams in order to embed security up and down the software development lifecycle
• Scope and execute assessments and threat models against a modern web stack
• Perform in-the-trenches pen testing work when needed
• Chain findings together into a meaningful threat narrative and write up results in a way that mobilizes engineers to act
• Help define our approach to AI security: evaluating risks introduced by LLM-backed features, agentic systems, and MCP servers, and establishing the scalable review patterns and guardrails we need to keep our engineers shipping secure software

Requirements:

• In addition to general management ability and a proactive leadership philosophy, you should bring demonstrated web application penetration testing ability, allowing you to scope and execute assessments and threat models against a modern web stack
• You should be proficient in Burp Suite, OWASP ZAP, or similar in order to perform in-the-trenches pen testing work when needed
• You should be able to chain findings together into a meaningful threat narrative and write up results in a way that mobilizes engineers to act
• You should have strong secure coding capabilities across TypeScript/JavaScript and Go, strong fluency with Linux systems and tooling, and practical experience threat modeling using STRIDE to help guide architecture-level decisions
• You should be familiar with SAST/DAST tooling and how to use their signals to drive meaningful risk reduction
• Prior experience in financial services or another highly regulated industry is a plus