Senior Security Engineer

Storm2; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Storm2 in San Francisco is seeking a Senior Security Engineer to own our security function across infrastructure, applications, and operations. You will partner with software teams to embed security into design and development of payments platforms that handle high-volume transactions.

You will secure AWS environments, lead incident response, oversee penetration testing and vulnerability management, and drive secure SDLC, cryptography and key management, PCI DSS and SOC 2 compliance.

Qualifications

• 5+ years of experience in Security Engineering, ideally within fintech, payments, or cloud-native environments.
• Strong hands-on experience securing AWS environments, including security tooling and infrastructure.
• Software development experience with Java.
• Demonstrable experience identifying and remediating security vulnerabilities.
• Hands-on experience with security incident response.
• Knowledge of PCI DSS and other security/regulatory frameworks.
• Experience with cryptography, HSMs, or key management.
• Strong written and verbal communication skills, with ability to communicate risks to technical and non-technical stakeholders.
• Experience with CI/CD security, Infrastructure as Code (Terraform), IAM, identity providers, penetration testing, or bug bounty programs is advantageous.
• Relevant security certifications such as CISSP or AWS Security Specialty are a plus.

Responsibilities

• Partner closely with Software Engineering teams to embed security into design and development of new products and features.
• Secure and improve the company's AWS infrastructure, endpoints, and broader technology environment.
• Lead and support security incident response, including investigation, remediation, and preventative measures.
• Manage security testing initiatives, including penetration testing, vulnerability scanning, and bug bounty programs.
• Triage security findings and drive remediation with engineering teams.
• Strengthen security of CI/CD pipelines and the software supply chain.
• Help define secure architecture around payments, sensitive data, and the SDLC.
• Support HSM operations, cryptographic key management, exchanges, and injections.
• Build and maintain security controls supporting PCI DSS, SOC 2, and other frameworks.
• Support security audits and respond to customer requirements.
• Help secure internal AI tooling and establish guardrails around AI use.

Skills

Security engineering

AWS security

Incident response

CI/CD security

Java development

Communication

Regulatory compliance

Cryptography / HSMs

Vulnerability management

Bug bounty awareness

Tools

AWS Security Hub

Terraform

Key management tools

Job description

Currently working with a fast-growing Series C fintech providing a payments processing system and embedded payments infrastructure for businesses, software platforms, and marketplaces. They enable their clients to accept online and in-person payments via phone, link, credit and debit cards, ACH, and digital wallets. They offer automated merchant onboarding and compliance checks and provide AI-driven fraud monitoring, dispute resolution and transaction reporting dashboards.

At a $1+ billion valuation, they are continuing to grow and scale their product and are looking for a Senior Security Engineer to own their security function. You'll work across infrastructure, application, implementation and operational security, partnering closely with engineering teams to ensure security scales alongside the platform

Responsibilities

• Partner closely with Software Engineering teams to ensure security is incorporated into the design and development of new products and features.
• Secure and continuously improve the company's AWS infrastructure, endpoints, and broader corporate technology environment.
• Lead and support security incident response, including investigation, remediation, and implementation of preventative measures.
• Manage security testing initiatives, including penetration testing, vulnerability scanning, and bug bounty programs.
• Triage security findings and work directly with engineering teams to drive vulnerability remediation.
• Strengthen the security of CI/CD pipelines and the software supply chain.
• Help define and maintain secure architecture around payment systems, sensitive data, and the software development lifecycle (SDLC).
• Support HSM operations, cryptographic key management, key exchanges, and key injections.
• Build and maintain security controls supporting PCI DSS, SOC 2, and other relevant regulatory frameworks.
• Support security audits and respond to security requirements from enterprise customers.
• Help secure internal AI tooling and establish appropriate security guardrails around the use of AI across the organization.

Requirements

• 5+ years of experience in Security Engineering, ideally within fintech, payments, or another cloud-native technology environment.
• Strong hands-on experience securing AWS environments, including AWS security tooling and infrastructure.
• Software development experience with Java.
• Demonstrable experience identifying and remediating security vulnerabilities.
• Hands-on experience with security incident response.
• Knowledge of PCI DSS and other security or regulatory frameworks.
• Experience with cryptography, HSMs, and/or key management.
• Strong written and verbal communication skills, with the ability to communicate security risks and recommendations to both technical and non-technical stakeholders.
• Experience with areas such as CI/CD security, Infrastructure as Code (Terraform), IAM, identity providers, penetration testing, or bug bounty programs is advantageous.
• Relevant security certifications such as CISSP or AWS Security Specialty are a plus.

Why Apply?

• Join a high-growth fintech business solving complex technical challenges within payments infrastructure.
• Work on security problems that directly impact high-volume, production-critical financial systems.
• Have broad ownership across application security, cloud security, infrastructure security, incident response, and compliance rather than being restricted to one area of security.
• Work closely with engineering teams and have a direct influence on how security is designed into products from the ground up.
• Gain exposure to highly relevant areas including AWS security, payments security, cryptography, PCI DSS, software supply chain security, and AI security.
• Take on a highly visible role where security is critical to the company's ability to scale its platform and products.
• Be part of a highly collaborative team, working in-office in San Francisco