Security Engineer, Business Continuity & Risk

Block is a technology company focused on expanding access to the global economy through financial and commerce products. Square Financial Services’ Risk Management team is seeking a Security Engineer to build and operate data pipelines, integrations, policy-as-code, and agentic AI workflows for third-party risk management, business continuity, evidence collection, and continuous control monitoring.

Responsibilities:

• Own and operationalize a SFS third-party risk management and business continuity program program
• Define the technical approach for ambiguous, cross-team problem spaces. This is an early-stage program, and you will frame problems as often as you solve them
• Build and operate the pipelines and integrations that aggregate, normalize, and join risk, control, and asset signals from systems of record across Block and SFS, including source control, the service registry, identity, ticketing, and data platforms
• Translate standards and compliance requirements into policy-as-code: enforceable, testable rules that run continuously. For example, "every production service has an accountable owner" becomes a versioned, tested check instead of a quarterly spreadsheet
• Design agentic AI workflows that pair LLM reasoning with deterministic, auditable decision layers for evidence analysis, control monitoring, classification, and assessment
• Automate evidence collection and continuous control monitoring to replace point-in-time audit preparation
• Partner with Security, Procurement, Resilience and Engineering teams to find the manual processes most worth turning into a product
• Contribute to technical design discussions, evaluating the security and reliability properties of the platform itself

Requirements:

• Third-party risk management and business continuity experience
• 4+ years building production software in backend, platform, data, or software engineering
• Multi-year ownership of a production system, including on-call, SLOs, and the maintenance work that starts after launch
• Proficiency with at least one of Python, Kotlin, Java, or Go, and comfort reading unfamiliar codebases
• Hands-on experience building with LLMs (prompting, tool use, agents, or LLM-backed features) and opinions about where model judgment belongs and where it doesn't. Judgment matters more here than volume
• Experience with integration patterns: REST APIs, webhooks, authentication flows, event-driven architectures
• Experience pulling, normalizing, and joining data from multiple imperfect sources, and handling the edge cases gracefully
• Experience defining technical direction where the problem was ambiguous, and carrying it across team boundaries
• Attention to detail balanced with pragmatism about risk-based prioritization
• Curiosity, persistence, and comfort operating with minimal structure in an early-stage program
• Ideal candidates will have familiarity with some of the technologies in our environment:
• Languages & Frameworks: Python, Java, Kotlin, Go
• AI: LLM APIs (we build on Claude), agent frameworks and tool-use patterns such as Model Context Protocol, eval harnesses
• APIs & Data: HTTP, JSON, gRPC, Protocol Buffers, SQL, Snowflake
• Infrastructure: AWS, GCP, Kubernetes, Terraform, CI/CD (Buildkite), event-driven architecture
• Working knowledge of a security or compliance framework such as PCI DSS, SOX, SOC 2, ISO 27001, or NIST
• Production-scale LLM or agentic systems experience