Fintech AppSec Leader: Secure AI-Driven SDLC

Cacheflow; San Francisco (CA); On-site; USD 268,000 - 321,000; Full time

Job summary

Kikoff exists to help millions of people build credit. This role focuses on shaping the Application Security pillar across web, mobile, and API surfaces, driving strategy, sequencing work, and delivering secure code with AI-assisted review.

You will design controls for code written by AI agents and ensure security by default as engineers move fast. You will own authentication and session security, API and mobile app protections, and lead vulnerability management programs to satisfy PCI-DSS, SOC

Qualifications

• 6+ years in security engineering with hands-on application security experience.
• Fluency in at least one of Ruby, Python, Go, or TypeScript and comfort reading all of them.
• Designed and shipped authentication/authorization systems (OAuth/OIDC, MFA, account recovery).
• Hands-on with modern AppSec tooling (SAST, SCA, DAST, secrets scanning) and CI/CD integration.
• Experience securing REST/GraphQL APIs and native mobile apps.
• Experience running a pentest or bug bounty program and working in fintech or regulated environments (PCI-DSS, SOC 2).

Responsibilities

• Drive the application security roadmap and secure SDLC.
• Define strategy, sequence work, and drive delivery for security initiatives.
• Build and enforce secure coding standards and tooling across teams.
• Own authentication and session security (MFA, recovery, session management).
• Secure APIs and mobile apps, including authorization models and device protection.
• Develop AI-assisted review and triage tooling to scale AppSec.

Skills

Security engineering

Application security

Production code writing

Threat modeling

Code review

Tools

SAST

SCA

DAST

Secrets scanning

CI/CD integration

Job description

Kikoff exists to help millions of people build credit. This role focuses on shaping the Application Security pillar across web, mobile, and API surfaces, driving strategy, sequencing work, and delivering secure code with AI-assisted review.

You will design controls for code written by AI agents and ensure security by default as engineers move fast. You will own authentication and session security, API and mobile app protections, and lead vulnerability management programs to satisfy PCI-DSS, SOC