Senior Security Engineer

Scalable Path; New York (NY); Remote; CAD 91,000 - 146,000; Part time

Job summary

Scalable Path is seeking an AI-first Security Engineer with an AWS CDK focus to join as a part-time, remote contributor. Your primary job is to own the security control surface of a multi-account AWS setup, including IAM, KMS, SSO, and per-tenant boundaries, with AI-generated CDK changes reviewed before deployment.

You will be the independent reviewer of record, ensuring least-privilege access, strong auditing, and SOC 2-aligned controls throughout CI gates and production boundaries.

Qualifications

• English required for collaboration with the team and stakeholders.
• Extensive experience with AWS concepts such as Organizations, IAM, KMS, SSO/identity, and multi-account design.
• AWS CDK and TypeScript proficiency to read and review AI-generated infrastructure.
• Familiarity with SOC 2 controls and building them into CI/pipelines.

Responsibilities

• Own AWS organization design, account structure, guardrails, and production deployment path.
• Manage IAM and access for offshore contractors with least-privilege, short-lived credentials, and 2FA.
• Oversee tenancy and key management, encryption posture, and audit logging.
• Review AI-generated infrastructure and code for security posture and control surface.
• Shape security posture of the AI gateway, including prompt-injection controls and provenance logging.
• Maintain evidence trails to support SOC 2 readiness from a running system.

Skills

English

AWS

DevOps

TypeScript

AWS CDK

Tools

AWS

CDK

TypeScript

DevOps

Job description

Scalable Path is looking for a part-time, AI-first Security Engineer with an AWS CDK Focus to join the team. This is a remote, full-time (40 hours/week) position.

Client company description

The client is a well-backed New York startup in building a generic loan origination and automated underwriting platform from scratch.

Overview

The client is building a loan origination and automated underwriting platform. The build is AI-primary: most of the code and infrastructure is generated by AI against a documented architecture, with two senior engineers reviewing what ships. You are the standing independent security eye on all of it — part-time, roughly half-time for the first three months while accounts, identity, keys, and CI gates are being built, then lighter and steady.

Your lane is the control surface: the AWS organization and account structure (dev, staging, prod-shaped), IAM and per-seat least-privilege access, SSO and identity, tenancy boundaries with per-tenant KMS keys, secrets handling with short-lived credentials, the audit spine, and the security gates in CI. Much of that will be authored by AI in CDK. Your job is to own it — design the boundaries, review every change to them, and be the person who says no. The platform is built to SOC 2-shaped controls by construction, without a formal program in this window, and never touches real borrower data outside production. You keep both of those true.

This suits someone who thinks in blast radius and trust boundaries, who can read a CDK stack or an IAM policy generated by someone — or something — else and see what it actually grants, and who is comfortable being the independent reviewer rather than the builder.

Responsibilities

• Own the AWS organization design: account structure, guardrails, SSO and identity, and the pipeline-only path to production — no human writes to prod.
• Own IAM and access for an offshore contractor team: per-seat least privilege, short-lived credentials, secrets that never leave vaults, 2FA everywhere, no shared accounts.
• Own tenancy and key management: per-tenant KMS boundaries, encryption posture, and the audit spine that records who did what.
• Own the security gates in CI: policy checks on CDK changes, dependency and secret scanning, and the rule that infrastructure changes need your sign-off.
• Review AI-generated infrastructure and security-relevant application code — CDK in TypeScript, auth, tenancy, data access — as the standing independent reviewer.
• Shape the security posture of the AI gateway: prompt-injection surface, kill switches, provenance logging, per-tenant metering.
• Keep controls evidence as you go, so a SOC 2 program or an external audit can start from a running system rather than a blank page.

Qualifications

• Senior security or platform-security engineer with deep AWS: Organizations, IAM, KMS, SSO/identity, VPC boundaries, CloudTrail. You have designed multi-account setups, not just operated inside one.
• Fluent with infrastructure as code, ideally CDK in TypeScript. You can read a synthesized stack and tell what it grants.
• You know what SOC 2-shaped controls look like in practice — change management through reviewed pipelines, access reviews, audit logging — and can build them by construction without a compliance program to lean on.
• Comfortable reviewing AI-generated code and infrastructure. You direct AI tooling yourself and know its failure modes on security-sensitive work.
• Comfortable being the reviewer of record for the control surface. You would rather own that judgment than the keystrokes.
• Strongly preferred: fintech or regulated-data experience; multi-tenant SaaS security; securing LLM-backed features.
• Nice to have: GitHub Actions hardening; security configuration of managed services such as Temporal Cloud.
• A plus: experience in mortgage or consumer lending — origination, underwriting, servicing, or the vendor ecosystem around them (credit bureaus, AVMs, fraud, e-signature, etc.).

Relationships - who you'll be working with

You will work directly with the co-founder — technical, hands-on, and the product owner — and with two senior full-stack engineers whose infrastructure and security-relevant changes you review. A junior engineer joins a month or two in. No layers between you and the decision-maker. Part-time: roughly half-time for the first three months, lighter after. Overlap with the US East Coast working day for at least a few hours, heavier during account and identity setup.

More than 12 months. If all works out, this is expected to be an ongoing role.

Required skills

• English (Must have)
• AWS (Must have)
• DevOps (Must have)
• TypeScript (Strongly preferred)
• AWS Cloud Development Kit (Strongly preferred)