Member of Technical Staff, Security Engineer

Wintermeyer Ventures; New York (NY); On-site; USD 150,000 - 250,000; Full time

Benefits offered by this job

On-site in NYC

Foundational security leadership role

Job summary

Wintermeyer Ventures in New York City is seeking a foundational security engineer to own the security program end-to-end as the first dedicated security hire, shaping security across product and engineering from day one.

You will secure AWS infrastructure (VPC, VPN peering, IAM, secrets management), embed app security (threat modeling, supply-chain controls, secure code review), and design audit trails for autonomous agents and access controls for both humans and AI systems.

Qualifications

• 3+ years in security engineering or infrastructure security.
• Hands-on AWS security controls experience (VPC, VPN peering, network segmentation, IAM, secrets management).
• Experience owning security end-to-end as the first or sole security hire at a startup.
• Identity and access management implementation covering SSO, RBAC, least-privilege design for human and non-human actors.
• Compliance and auditability program experience (SOC 2, pentest coordination, vulnerability management).

Responsibilities

• Own infrastructure security across the full AWS environment (VPC, VPN, segmentation, IAM, secrets).
• Embed application security practices (threat modeling, supply‑chain controls, secure code review).
• Build and manage identity and access controls for human users and AI agents (SSO, RBAC).
• Design audit trails and access controls for autonomous agent activity with data lineage."
• Stand up and run security programs (bug bounty, vulnerability disclosure, pentest coordination).

Skills

Security engineering

AWS security

Threat modeling

Identity & access management

Compliance management

Tools

VPC

VPN peering

IAM

Secrets management

SSO

RBAC

Job description

About the Role

This is a foundational security engineering role at a fintech startup, where you will own the entire security program end-to-end as the first dedicated security hire. From infrastructure to application to compliance, you will shape how security is built into the product and culture from day one, making the secure path the default path for a fast-moving engineering team.

What You'll Do

• Own infrastructure security across the full AWS environment, including VPC and VPN peering, network segmentation, IAM, and secrets management.
• Embed application security practices, such as threat modeling, dependency and supply-chain controls, and secure code review, into how the team designs and ships software across web and desktop clients.
• Build and manage identity and access controls (SSO, RBAC, least-privilege) for both human users and AI agents, ensuring every actor has access to exactly what it needs.
• Design audit trails and access controls that make autonomous agent activity fully reconstructable, capturing what it did, on whose behalf, with what data, and why.
• Partner with the IT managed service provider to manage endpoint security, device management, and access controls for an in-office team.
• Stand up and run compliance, auditability, bug bounty, vulnerability disclosure, and pentest programs that demonstrate security posture to clients, partners, and auditors.

What We're Looking For

• 3 or more years in security engineering or infrastructure security, with hands-on delivery of AWS security controls (VPC, VPN peering, network segmentation, IAM, secrets management).
• Hands-on application security experience including threat modeling, dependency and supply-chain controls, and secure code review.
• Experience owning security end-to-end as the first or sole security hire at a startup, building programs from the ground up with minimal established process.
• Identity and access management implementation experience covering SSO, RBAC, and least-privilege design for both human and non-human actors.
• IT security experience spanning endpoint security, device management, and access controls.
• Compliance and auditability program experience, such as SOC 2, pentest coordination, and vulnerability management.
• Comfort operating autonomously in fast-moving environments with broad ownership.
• Experience in financial services or other regulated industries is a plus.
• Experience securing AI or agent systems, including audit trails for autonomous actors, is a plus.
• Experience standing up bug bounty and vulnerability disclosure programs from scratch is a plus.

Compensation & Benefits

Salary range: $150,000 to $250,000 USD annually. Visa sponsorship is not available for this role.

Location

This role is on-site in New York City, NY, United States.