Senior Security Engineer - Application, Cloud & Automation

VelaFi provides global payment and stablecoin infrastructure for businesses. The Senior Security Engineer protects payment applications, transaction workflows, and cloud infrastructure by identifying and driving remediation of security risks, strengthening controls, and building security automation.

Responsibilities:

• Application Security & Penetration Testing: Conduct security reviews and authorized penetration testing of APIs, authentication, authorization, merchant isolation, and webhooks. Validate business logic vulnerabilities and attack paths, support remediation, and verify fixes
• Payment & Funds Security: Assess the security of deposits, withdrawals, internal transfers, and wallet or custody integrations. Focus on transaction authorization, request authenticity, duplicate transaction prevention, signing permissions, and approval workflows to identify risks that could enable unauthorized movement of funds
• Cloud & Infrastructure Security: Partner with DevOps to strengthen security across AWS, Kubernetes, databases, and CI/CD pipelines. Implement least privilege, environment isolation, network access controls, secrets management, and privileged activity auditing
• Security Engineering & Automation: Integrate code, dependency, secrets, container, and infrastructure configuration checks into development and release workflows. Build security tools and tests, manage false positives, and turn critical business risks into repeatable security checks
• Security Monitoring & Incident Response: Improve detection rules across cloud, application, and business logs. Lead security investigations and work with relevant teams on containment, remediation, evidence preservation, and post-incident reviews. Establish clear escalation and response procedures
• AI & Agent Security: Use AI to support code review, threat modeling, vulnerability analysis, test generation, and log investigation while independently validating its outputs. Assess data access, tool permissions, prompt injection, and sensitive actions in the company's AI tools and agents
• Risk Prioritization & Remediation: Prioritize findings based on exploitability and business impact. Work with Engineering, DevOps/IT, and Risk to establish remediation owners and plans, track issues through resolution, and coordinate external security assessments when needed

Requirements:

• Typically 5+ years of relevant security engineering experience, or equivalent demonstrated delivery in complex environments
• Strong application security and penetration testing skills
• Ability to read backend code, identify authentication, authorization, API, and business logic vulnerabilities, and recommend practical fixes
• Hands-on experience with AWS and cloud-native environments, including IAM, Linux, containers, Kubernetes, database access controls, and CI/CD security
• Proficiency in at least one programming language, such as Python, Go, or JavaScript, with the ability to build validation scripts, security tools, automated tests, and supporting code changes
• Practical experience using AI/LLM tools, including the ability to explain how they improved your work and recognize incorrect outputs, sensitive data exposure, and excessive permissions
• Ability to work independently within a lean team, prioritize based on business impact, and clearly communicate risks, solutions, and resource needs to technical and nontechnical stakeholders
• Experience in payments, FinTech, digital assets, or other security-sensitive environments
• Knowledge of transaction authorization, ledger integrity, wallet or custody integrations
• Experience in incident response, vulnerability research, or open-source contributions
• Experience building security engineering and automation capabilities from the ground up
• Familiarity with Infrastructure as Code, Policy as Code, or AI agent security
• Relevant certifications such as OSCP, OSWE, or AWS Certified Security – Specialty are a plus