Founding Security Engineer

Cascading AI Inc.; San Francisco, Northern (CA, KY); Hybrid; USD 150,000 - 210,000; Full time

Benefits offered by this job

Impact & Ownership

Collaborative Environment

Competitive Compensation

Professional Growth

Culture of Innovation

Job summary

Casca is building AGI for banking and is focused on security-first engineering across a multi-tenant cloud platform. As an AppSec-focused engineer, you will own detections, policy-as-code, and CI/CD checks, while shaping threat models around authentication, tenant isolation, and data handling.

You will address the AI attack surface and oversee incidents from discovery to remediation. You will collaborate with the engineering team, communicate risk in concrete terms to developers, and work with

Qualifications

• Several years of AppSec experience with bugs you found, incidents you ran, and systems you hardened.
• You write production code in TypeScript/Node.js and Python.
• You know where security boundaries break in multi-tenant systems, and why authorization matters.
• You can explain risk to an engineer in engineering terms and ship fixes without escalation.
• You can face a bank's security team and leave them more confident.

Responsibilities

• Own software security controls: detections, libraries, policy-as-code, automation, and CI/CD checks.
• Create threat models and design reviews focusing on auth, tenant isolation, and data handling.
• Address AI attack surface: prompt injection, tool abuse, exfiltration paths, and evaluation of controls.
• Manage end-to-end incident response, write-ups, and post-incident fixes.
• Support bank security reviews and audits by turning findings into engineering work.

Skills

AppSec experience

TypeScript/Node.js

Python

Multi-tenant security

Tools

CI/CD tooling

Job description

Why Casca?

Casca is building AGI for banking. We’re replacing decades-old legacy systems with AI-native technology that automates 90% of the manual work humans once had to do.

Why this role exists

Our customers are FDIC-insured banks. Every one of them puts us through security review, control questionnaires, pen test results, and third-party risk assessment before we touch production. Then they hand us borrower tax returns, bank statements, and the data behind credit decisions on their own balance sheet.

So security isn't a compliance checkbox here. It's a precondition for the company existing. Every deal we win depends on it, and one bad breach ends the business.

The surface area is large and getting larger: a multi-tenant AI platform, a cloud estate under bank data-handling requirements, agents that read and act on customer data, and an engineering team shipping into all of it every day. Nobody can review their way across that. You build the guardrails, defaults, and tooling that scale past you.

What you'll own

• Software. Detections, libraries, policy-as-code, automation, CI/CD checks — reviewed, tested, and deployed like any other service.

• Design reviews and threat models on what actually matters: auth, tenant isolation, data handling, anything touching borrower PII.

• The AI attack surface. Prompt injection, tool-use abuse, exfiltration paths through agents, and the evals that tell you whether your controls hold.

• Incidents, end to end, including the write-up and the fixes that follow.

• Bank security reviews and audits, turned into engineering work that improves the system rather than paperwork that describes it.

What we look for

• Several years of experience in AppSec, with specifics you can walk us through: bugs you found, incidents you ran, systems you hardened, tooling you shipped.

• You write production code. We work primarily in TypeScript/Node.js and Python.

• You know where security boundaries break in multi-tenant systems, and why it's usually authorization.

• You can explain risk to an engineer in engineering terms and get the fix shipped without escalating.

• You can sit across from a bank's security team, take hard questions honestly, and leave them more confident than when you walked in.

• Steady during incidents. Honest afterward.

• You'd rather build leverage than become a bottleneck.

Helpful, not required

• Securing LLM or agentic products in production.

• Standing up a security function at a fast-growing company.

• Working inside or selling into regulated financial institutions: SOC 2, GLBA, FFIEC guidance, third-party risk, exam support.

What you'll get:

• Impact & Ownership: A unique opportunity to shape the future of banking through AI, owning end-to-end product initiatives.

• Collaborative Environment: Work alongside a talented and passionate team that values continuous improvement and knowledge sharing.

• Competitive Compensation: Includes salary, benefits, and potential equity in a fast-growing startup.

• Professional Growth: Access to resources and mentorship to expand your skill set, influence strategy, and accelerate your career.

• Culture of Innovation: We encourage risk-taking, learning from failures, and pushing the boundaries of what’s possible in fintech.

As an early-stage company building at the frontier of AI, we work with high intensity and commitment. While schedules can vary by role/team, many weeks will demand extra focus, flexibility and time particularly during major launches and high impact sprints. We're seeking those who are aligned to and able to commit to that expectation.