Security Engineer, Business Continuity & Risk

Block; California; Hybrid; USD 160,000 - 270,000; Full time

Benefits offered by this job

Remote work

Medical insurance

Flexible time off

Retirement savings plans

Family planning benefits

Job summary

Block is seeking a senior engineer to scale risk management and business continuity—building data pipelines, integrations, and AI‑driven governance. You will define technical direction across teams and create auditable, policy‑driven controls that operate continuously.

You will partner with Security, Resilience, and Engineering to turn manual processes into scalable products, using Python/Java/Kotlin/Go and modern data platforms. Strong cloud and data skills are essential.

Qualifications

• Experience in third‑party risk management and business continuity.
• 4+ years building production software in backend/platform/data/engineering.
• Ownership of a production system with on‑call and SLOs.
• Proficiency in Python, Kotlin, Java, or Go.
• Hands‑on experience with LLMs and agentic workflows.
• Experience with REST APIs, webhooks, authentication flows, event‑driven architectures.
• Experience pulling and joining data from multiple sources.
• Ability to define technical direction across teams.
• Attention to detail with risk‑based prioritization.
• Curiosity and comfort in early‑stage programs.

Responsibilities

• Own and operationalize a third‑party risk management and business continuity program.
• Define the technical approach for ambiguous, cross‑team problems.
• Build and operate pipelines that aggregate and join risk signals across systems.
• Translate standards into policy‑as‑code and verifiable checks.
• Design agentic AI workflows with auditable decision layers.
• Automate evidence collection and continuous control monitoring.
• Partner with Security, Procurement, Resilience and Engineering teams.
• Contribute to technical design discussions on platform reliability.

Skills

Third‑party risk management

Production software

On‑call ownership

Python

Kotlin

Java

Go

LLM / agentic workflows

REST APIs / webhooks

Data integration

Technical direction

Risk prioritization

Curiosity / persistence

Tools

Python

Java

Kotlin

Go

Job description

Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block.

The Role

Square Financial Services, Inc. (SFS) is Block’s bank. We opened in March 2021 and provide lending and FDIC‑insured deposit products to individuals and small businesses on a nationwide basis.

SFS Risk Management is scaling vendor security, third party risk, and business continuity through innovation. Our Risk team designs and promotes the frameworks, standards, and oversight that elevates security considerations among our vendors, simplifies our regulatory obligations, and ensures resilience in our business operations. The team also operates the agent‑first platforms that turn those frameworks into running systems.

Most of governance is a data problem. The risk, control, and asset information needed to answer "are we secure and compliant?" is dispersed across dozens of systems: Security Engineers treat that as an engineering problem. You'll build the data pipelines, integrations, and agentic AI workflows that turn manual governance processes into products that run continuously, produce measurable results, and hold up to audit end to end.

You Will

• Own and operationalize a SFS third‑party risk management and business continuity program program.
• Define the technical approach for ambiguous, cross‑team problem spaces. This is an early‑stage program, and you will frame problems as often as you solve them.
• Build and operate the pipelines and integrations that aggregate, normalize, and join risk, control, and asset signals from systems of record across Block and SFS, including source control, the service registry, identity, ticketing, and data platforms.
• Translate standards and compliance requirements into policy‑as‑code: enforceable, testable rules that run continuously. For example, "every production service has an accountable owner" becomes a versioned, tested check instead of a quarterly spreadsheet.
• Design agentic AI workflows that pair LLM reasoning with deterministic, auditable decision layers for evidence analysis, control monitoring, classification, and assessment.
• Automate evidence collection and continuous control monitoring to replace point‑in‑time audit preparation.
• Partner with Security, Procurement, Resilience and Engineering teams to find the manual processes most worth turning into a product.
• Contribute to technical design discussions, evaluating the security and reliability properties of the platform itself.

You Have

• Third‑party risk management and business continuity experience.
• 4+ years building production software in backend, platform, data, or software engineering
• Multi‑year ownership of a production system, including on‑call, SLOs, and the maintenance work that starts after launch
• Proficiency with at least one of Python, Kotlin, Java, or Go, and comfort reading unfamiliar codebases
• Hands‑on experience building with LLMs (prompting, tool use, agents, or LLM‑backed features) and opinions about where model judgment belongs and where it doesn't. Judgment matters more here than volume
• Experience with integration patterns: REST APIs, webhooks, authentication flows, event‑driven architectures
• Experience pulling, normalizing, and joining data from multiple imperfect sources, and handling the edge cases gracefully
• Experience defining technical direction where the problem was ambiguous, and carrying it across team boundaries
• Attention to detail balanced with pragmatism about risk‑based prioritization
• Curiosity, persistence, and comfort operating with minimal structure in an early‑stage program

Nice To Have

• Working knowledge of a security or compliance framework such as PCI DSS, SOX, SOC 2, ISO 27001, or NIST. Prior GRC experience is not required; we can teach the governance side
• Production‑scale LLM or agentic systems experience

You Know

• Languages & Frameworks: Python, Java, Kotlin, Go
• AI: LLM APIs (we build on Claude), agent frameworks and tool‑use patterns such as Model Context Protocol, eval harnesses
• APIs & Data: JSON, gRPC, Protocol Buffers, SQL, Snowflake
• Infrastructure: AWS, GCP, Kubernetes, Terraform, CI/CD (Buildkite), event‑driven architecture

We’re working to build a more inclusive economy where our customers have equal access to opportunity, and we strive to live by these same values in building our workplace. Block is an equal opportunity employer evaluating all employees and job applicants without regard to identity or any legally protected class. We will consider qualified applicants with arrest or conviction records for employment in accordance with state and local laws and “fair chance” ordinances.

We believe in being fair, and are committed to an inclusive interview experience, including providing reasonable accommodations to disabled applicants throughout the recruitment process. We encourage applicants to share any needed accommodations with their recruiter, who will treat these requests as confidentially as possible.

While there is no specific deadline to apply for this role, U.S. roles are typically open for an average of 55 days before being filled by a successful candidate. Please refer to the date listed at the top of this job page for when this role was first posted.

Block takes a market‑based approach to pay, and pay may vary depending on your location. U.S. locations are categorized into one of four zones based on a cost of labor index for that geographic area. The successful candidate’s starting pay will be determined based on job‑related skills, experience, qualifications, work location, and market conditions. These ranges may be modified in the future.

Zone A

$180,000—$270,000 USD

Zone B

$171,000—$256,600 USD

Zone C

$162,000—$243,000 USD

Zone D

$153,000—$229,600 USD

Use of AI in Our Hiring Process

We may use automated AI tools to evaluate job applications for efficiency and consistency. These tools comply with local regulations, including bias audits, and we handle all personal data in accordance with state and local privacy laws.

Benefits

• Every benefit we offer is designed with one goal: empowering you to do the best work of your career while building the life you want.
• Remote work, medical insurance, flexible time off, retirement savings plans, and modern family planning are just some of our offering.
• Check out our other benefits at Block.
• Block, Inc. (NYSE: XYZ) builds technology to increase access to the global economy.
• Each of our brands unlocks different aspects of the economy for more people.
• Square makes commerce and financial services accessible to sellers.
• Cash App is the easy way to spend, send, and store money.
• Afterpay is transforming the way customers manage their spending over time.
• TIDAL is a music platform that empowers artists to thrive as entrepreneurs.
• Bitkey is a simple self‑custody wallet built for bitcoin.
• Proto is a suite of bitcoin mining products and services.
• Together, we’re helping build a financial system that is open to everyone.

Privacy Policy