Founding Security Engineer

Karat Financial is hiring its first dedicated security engineer to build and own the security program for its banking, charge card, and payments products. The role covers cloud and application security, corporate and endpoint security, detection and response, and technical compliance work with auditors and bank partners.

Responsibilities:

• Own our cloud security posture: IAM and least privilege, network segmentation, secrets management, WAF and edge rules, logging, backups, and infrastructure as code
• Secure how we ship: source control access, CI/CD, dependency and secrets scanning, environment separation, and production access that is auditable without being painful
• Own corporate and endpoint security: identity and SSO, OAuth scope and sharing audits, device management with automated onboarding and offboarding, phishing-resistant MFA with hardware keys and passkeys, and a laptop baseline that's enforced as code with staged rollouts
• Run the technical side of our SOC 2 program and bank partner due diligence: controls as code, evidence that collects itself, network and data-flow diagrams, pen test coordination, vendor security reviews, and the security questionnaires our partners send
• Build detection and response: centralize logs, write the alerts that matter for a fintech (account takeover, privileged access, unusual money movement), write the runbooks, and be first call when something looks wrong
• Partner with product engineers on application security: threat-model new features (payouts, card issuance, KYC flows), review the risky PRs, and ship security features our customers see, like passkeys and session hardening
• Set the rules for how Karat uses AI agents and tools safely: what they can access, what gets logged, and where customer data can and can't go
• Keep us current. You'll track what's happening to other fintechs (account takeover rings, support-desk social engineering, supply-chain compromises) and translate it into what we change this quarter
• Build paved roads, not gates. When engineers or ops teammates route around a control, treat that as a bug in the control

Requirements:

• 5+ years in infrastructure, DevOps, platform, or security engineering, including years spent building and running production systems on a major cloud provider. You've been on call for something that mattered
• You write code and ship it. Infrastructure as code (Terraform, Pulumi, or similar), plus fluency in at least one of TypeScript, Python, or Go
• Hands-on with the corporate side: a productivity suite like Google Workspace or Microsoft 365, an MDM, an identity provider, and hardware security keys. You've rolled these out to real people and dealt with the fallout
• You've built or materially run the technical side of a SOC 2, PCI, or bank partner audit at a company that didn't have a compliance team to hand it to
• Founder DNA. You've started something, or you were one of the first 20 people somewhere and owned a function nobody else would. You're comfortable deciding what matters when nobody tells you
• Finance or fintech experience, and interest in it. You've worked at a bank, a fintech, a payments company, or in another regulated environment, and you understand why a bank partner asks the questions it asks
• A track record of choosing not to ship a control because the friction wasn't worth the risk reduction. You can tell us about one
• You follow the field closely. You can talk about the last few incidents at fintechs and what you'd have done differently, and you have opinions about passkeys, device trust, and securing AI agents
• Clear writing. Auditors, bank partners, and teammates will read what you write, and most of your influence will come through it
• Visa: US citizen/visa only
• Edge security depth: WAF, zero trust access, and DNS
• Detection engineering: you've built alerting from raw logs without a big SIEM budget
• You've shipped WebAuthn or passkey support in a product
• You've sat on the company side of a BaaS or sponsor bank audit
• You've built security controls for LLM tooling or agents: access scoping, logging, data handling
• Public work: open source, writeups, talks, or a bug bounty profile