Senior Security Engineer

Credit Sesame, Inc.; Texas; On-site; USD 170,000 - 215,000; Full time

Benefits offered by this job

Equity in pre-IPO company

Medical, dental, and vision insurance

Home office stipend

Professional development program

Flexible paid time off

10 holidays + 6 Wellness days

Wellness-focused culture

Job summary

Credit Sesame, Inc. seeks a seasoned Security Engineer to own end-to-end security for our Sesame Platform. You will oversee tooling, automation, and vulnerability management across cloud and endpoints while driving secure-by-default practices.

You will lead incident response, ensure PCI DSS and SOC 2/ISO 27001 compliance, and partner with DevOps on secure infrastructure. Strong automation and communication skills are essential.

Qualifications

• 7+ years of hands-on security engineering across application, cloud, and network security.
• Independently drive tooling/architecture decisions and defend them to leadership.
• Self-directed, pragmatic, and ruthless about prioritization.
• Built production automation via API integrations and internal tooling.
• Hands-on experience deploying OSS security tools (as listed).
• Solid AWS security experience.
• Knowledge of PCI DSS, SOC 2, and ISO 27001 controls and audits.
• Curious about AI/LLM security domains and threat modeling.
• Excellent communicator who translates risk for engineers and executives.
• Bonus: OSCP/GPEN, bug bounty, startup experience, or securing AI-based systems.

Responsibilities

• Run security reviews for new tools, vendors, and projects including DPAs, PII, and third-party security reports.
• Own access and infrastructure security: IAM least-privilege, S3/database access, network configs.
• Manage vulnerability programs across cloud and endpoints and IDS/IPS tooling.
• Lead security incident response end-to-end and build runbooks.
• Support PCI DSS, SOC 2, ISO 27001 compliance programs with audits and risk metrics.
• Collaborate with DevOps/IT on patch management and secure defaults.
• Build in-house AppSec scanning program and integrate into CI (GitLab CI, Jenkins).
• Develop security tooling and automation with Python/boto3 and API integrations.
• Create detection pipelines (traffic, bot-protection, ELK/Kibana) and alert rules.
• Threat-model AI/LLM systems and coordinate external pentests as needed.
• Maintain security policies and drive company-wide security training.

Skills

Security engineering

Application security

Cloud security

Network security

Penetration testing

OSS security tools

AWS security

Threat modeling

Communication

Startup experience

Education

BS in Computer Science or related field

Tools

Burp Suite

OWASP ZAP

Nmap

Nuclei

Metasploit

Semgrep

Trivy

Wazuh/OSSEC

ELK/Kibana

Prowler/ScoutSuite

HashiCorp Vault

Job description

Credit Sesame is a leading financial wellness platform dedicated to helping consumers achieve better financial health through cutting-edge technology and data-driven solutions. With a decade of credit expertise and a proven track record of serving over 18 million users, Credit Sesame leverages AI and advanced analytics to empower individuals to better understand and manage their credit. Our recently launched Sesame Platform extends our mission by providing financial institutions with a turnkey AI-powered credit intelligence solution. As our security engineer, you'll own security end-to-end for our platform — standing up open-source tooling, writing your own scripts and automation, and running assessments.

You'll...

• Run security reviews for new tools, vendors, and projects — data handling, AI usage, DPAs, PII, authentication/authorization, and third-party security reports (SOC 2, PCI, ISO, pentest results);
• Own access and infrastructure security — IAM least-privilege reviews, S3/database access controls, environment segregation, service-to-service authentication, and network configuration audits (VPC flow logs, inbound/outbound rules);
• Run vulnerability management across cloud and endpoints, and manage IDS/IPS (e.g., Palo Alto Panorama, AWS WAF) and EDR/MDR tooling;
• Lead security incident response end to end — triage, investigate, contain, document, and build the runbooks as you go;
• Implement and maintain the technical controls supporting our PCI DSS and SOC 2 / ISO 27001 compliance programs, including internal audits, risk metrics, and disaster recovery planning;
• Partner with DevOps/IT on patch management and secure infrastructure defaults, and present tooling and risk recommendations to engineering leadership;
• Build our in-house AppSec scanning program — evaluate and pilot SAST/SCA/IaC tooling (Semgrep, Trivy, Upwind), integrate into GitLab CI and Jenkins, define severity-based remediation SLAs, and drive rollout across services;
• Build internal security tooling and automation — custom scripts and integrations (Python/boto3, APIs) that pull data from tools without native integrations into shared dashboards and reports;
• Build and tune detection pipelines — for example, feeding traffic/bot-protection alerts (Datadome) into our log platform (ELK/Kibana) and writing rules that catch real attack patterns;
• Threat-model and pentest our AI/LLM systems — scope risks like prompt injection and data exfiltration through MCP servers, coordinate external pentests where needed, and drive remediation;
• Maintain security policies and practices and drive training and adoption throughout the company.

You're a great fit because...

• You have 7+ years of hands-on security engineering experience across application security, cloud security, and network/penetration testing — not just one lane;
• You've driven tooling or architecture decisions independently (evaluated options, made the call, defended it to leadership);
• You're self-directed, pragmatic, and ruthless about prioritization;
• You've built production automation from scratch — API integrations, custom collectors, or internal tooling — not just one-off scripts;
• You have hands-on experience deploying and running OSS security tools — Burp Suite Community/OWASP ZAP, Nmap, Nuclei, Metasploit, Semgrep, Trivy, Wazuh/OSSEC, ELK/Kibana, Prowler/ScoutSuite, HashiCorp Vault, or similar;
• You have solid AWS security experience;
• You have working knowledge of PCI DSS, SOC 2, and ISO 27001 — enough to implement controls and support audits;
• You're curious about emerging security domains and comfortable threat-modeling systems (like AI/LLM applications) that don't have an established playbook yet;
• You're an excellent communicator who can translate cost/coverage tradeoffs and technical risk for both engineers and executives;
• Bonus: OSCP, GPEN, or similar certifications; bug bounty experience; prior experience at a startup; or experience securing LLM/AI-based systems;
• BS in Computer Science or related field, or equivalent hands-on experience.

You'll love it here because...

• You’ll have equity in a pre-IPO company backed by top VCs;
• We offer comprehensive medical, dental, and vision insurance;
• We offer a monthly home office stipend;
• We offer a professional development program to support your continued growth
• We offer flexible paid time off;
• We have 10 paid holidays and additional 6 Sesame Wellness days;
• We prize EQ and empathy, and have a culture that emphasizes total wellness, including work-life harmony.

At Credit Sesame, base pay is one part of our total compensation package. The estimated pay range for this role is $170,000 - $215,000 with actual salary based on a candidate’s location, qualifications, skills, and experience. Additionally, this role is eligible to participate in Credit Sesame’s equity plans. We are open to hiring for this role in the following states where we are set up to hire employees: CA, CO, NC, NJ, NV, and TX.

Artificial Intelligence Notice: Credit Sesame may use artificial intelligence tools to assist in reviewing application materials against job-related qualifications. These tools support the recruiting process and are not used to automatically select, reject, or evaluate candidates. Humans, including our recruiters and hiring managers, make all final decisions regarding interviews and offers. Applicants may contact People Operations to request a reasonable accommodation.