Platform Security Engineer

Causa Prima; España; On-site; PHP 3,075,031 - 4,612,546; Full time

Job summary

Causa Prima in the Philippines is seeking a Backend Security Engineer to design and build the System Integrity Layer. In this hands-on role, you will ensure the security and reliability of our systems through superior architecture. Candidates should have over 5 years of experience in backend platform design and distributed systems.

The position requires deep knowledge of security architecture and threat modeling, with a focus on regulatory compliance in fintech or other regulated environments.

Qualifications

• 5+ years designing production backend platforms and distributed systems design.
• Deep schema design, RLS, and event-sourcing database expertise.
• Practical application-level security, encryption models, key management, and auth patterns.
• Think like an attacker to uncover vulnerabilities.

Responsibilities

• Design the core execution model for autonomous agents.
• Conduct continuous code-level threat modeling.
• Build tamper-resistant event systems.
• Engineer strict execution and data isolation layers.
• Run active internal pentesting and adversarial chaos testing.
• Ensure agent accounting processes are strict and deterministic.
• Architect our software delivery pipeline for integrity.
• Translate regulatory requirements into system constraints.

Skills

Backend platform design

Distributed systems design

Security architecture

Threat modeling

Database schema design

Policy-as-Code

Tools

Cerbos

OPA

Cedar

Kafka

Redpanda

Job description

In this role, you will design and build the System Integrity Layer, establishing the foundational platform primitives that guarantee every agent action is isolated and attributable, every execution is traceable, every state transition is verifiable, and every software release satisfies strict security constraints by construction. This is a hands‑on backend security engineering role where security, threat resilience, and compliance are natural outcomes of brilliant system architecture, not separate, bureaucratic processes. We are looking for a builder, not a governance operator, someone who treats trust guarantees as core system properties designed directly into the database and application layers from day one.

What you’ll do

• System Integrity Layer & Threat Modeling - Design the core execution model that governs how autonomous agents run, interact, and modify system state.
• Proactive Threat Modeling: Conduct continuous, code‑level threat modeling across our distributed networks to identify structural vectors, memory leakage, prompt manipulation, and authorization bypasses before a single line hits staging.
• Auditability as a Native Property: Build append‑only, tamper‑resistant event systems that make every action reconstructable without relying on external logging frameworks or reactive "audit tooling."
• Isolation, Trust Boundaries, & Adversarial Testing: Engineer strict execution and data isolation layers between agents, users, and workflows in a multi‑tenant infrastructure.
• Continuous Offensive Testing: Run active internal pentesting, adversarial chaos testing, and targeted red teaming exercises against our own infrastructure to aggressively expose flaws in isolation barriers and cryptographic verification boundaries.
• Agent Execution Guarantees: Ensure all automated, agentic accounting processes are strictly attributable, deterministic where required, verifiable in hindsight, and unalterably constrained by explicit system rules.
• Robust Engineering & Pipeline Security: Architect and refine our internal software delivery pipeline to guarantee absolute integrity from code commit to production deployment.
• Build deterministic verification mechanisms into the CI/CD pipeline, ensuring that all third‑party dependencies, agent libraries, and compiled services are cryptographically signed, scanned, and secure by default.
• Compliance Through Architecture: Translate complex regulatory and audit requirements directly into low‑level system constraints, completely eliminating the need for reactive operational processes or manual review workflows.

What we’re looking for

• Experience: 5+ years designing production backend platforms and distributed systems design.
• Database experience: Deep schema design, RLS, and event‑sourcing database expertise.
• Security Architecture: Practical application‑level security, encryption models, key management, and auth patterns.
• Adversarial Mindset: You naturally think like an attacker to uncover race conditions, logic flaws, and vulnerabilities.
• Policy‑as‑Code: Hands‑on experience with Cerbos, OPA, Cedar, or similar.
• Domain knowledge: Experience in fintech/accounting/banking or other heavily regulated environments.

Nice to have

• Cryptographic primitives
• Event streaming (Kafka/Redpanda)