Senior Security Engineer

Storm2; California; On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Equity compensation

Benefits package

Job summary

Storm2’s client is a San Francisco-based payments infrastructure company delivering scalable payment solutions for businesses of all sizes. The Security Engineer, Payments Infrastructure will own security across AWS infrastructure and the corporate environment, partnering with engineers to influence architecture and drive remediation from design through to production.

You’ll work across PCI scope, cryptographic keys, and the software supply chain, ensuring robust security controls and incident

Qualifications

• Minimum 5+ years of hands-on security engineering experience.
• Proven ability to remediate vulnerabilities, not just report them.
• Strong AWS security experience in production environments.
• Java development experience and secure coding practices.
• Incident response leadership and coordination.
• Knowledge of PCI DSS and security controls in regulated contexts.
• Cryptography and key-management experience.
• Clear communication of security decisions to engineers and stakeholders.

Responsibilities

• Partner with engineering on threat modelling, secure design and implementation.
• Secure AWS infrastructure and employee workstations.
• Lead security incident response and remediation.
• Own vulnerability management across scanning, pentests and bug bounty.
• Hardening CI/CD pipelines and software supply chain.
• Support PCI architecture and HSM key operations.
• Define security controls and guardrails for internal AI tooling.

Skills

Security engineering

AWS security

Java development

Vulnerability remediation

Incident response

PCI DSS controls

Cryptography & keys

Communication with engineers

Tools

Terraform

CI/CD security

Okta

CrowdStrike

Palo Alto Prisma Access

Nexus

Bug bounty

Job description

Security Engineer, Payments Infrastructure

San Francisco, CA, In-office

$180,000 to $240,000 + Equity + Benefits

The Company

Storm2’s client is a San Francisco-based payments infrastructure company building technology used by businesses ranging from startups through to public companies. Founded in 2015, the business now processes tens of billions of dollars annually across online and in-person payments and has raised more than $200m.

The Role

Payments security gets complicated quickly. Cloud infrastructure, application security, PCI scope, cryptographic keys and the software supply chain all matter, and this role sits across all of them.

You’ll partner directly with engineers on how products are designed and shipped, while owning security across AWS infrastructure and the corporate environment. This isn’t a security role built around producing findings and handing them over. You’ll be expected to understand the problem technically, influence the architecture, and drive remediation through to completion.

The breadth is deliberate. One week could involve reviewing the security model for a new payments feature, the next could mean coordinating a pentest, tightening CI/CD controls, working through PCI architecture or supporting an HSM key operation.

What you’ll be working on:

• Partnering with engineering teams on threat modelling, secure design and implementation
• Securing AWS infrastructure and employee workstations
• Leading security incident response and subsequent remediation
• Owning vulnerability management across scanning, pentests and bug bounty findings
• Hardening CI/CD pipelines and the wider software supply chain
• Working with engineering on PCI architecture, including scope, data handling and secure SDLC
• Supporting HSM operations, key exchanges and key injections
• Building and maintaining technical controls for PCI DSS and SOC 2
• Supporting audit fieldwork and customer security reviews
• Defining security controls and guardrails around internal AI tooling

What you’ll bring:

• 5+ years of hands-on security engineering experience
• Strong AWS security experience in a production environment
• Software development experience with Java
• Experience finding and actually remediating vulnerabilities, not just reporting them
• Hands-on incident response experience
• Working knowledge of PCI DSS and security controls within regulated environments
• Practical cryptography and key-management experience
• The ability to communicate security decisions clearly with engineers and non-technical stakeholders

Useful, but not essential:

Terraform, CI/CD security, Okta, CrowdStrike, Palo Alto Prisma Access, Sonatype Nexus, bug bounty or pentesting experience, plus certifications such as AWS Certified Security - Specialty or CISSP.