Senior Security Engineer - Application, Cloud & Automation

VelaFi; Dallas (TX); Sur place; USD 120 000 - 190 000; Plein temps

Résumé du poste

VelaFi is a fast-growing FinTech infrastructure provider seeking a hands-on Senior Security Engineer to protect our payment applications, transaction workflows, and cloud infrastructure. You will think like an attacker, work directly with code and systems, and partner with Engineering, DevOps, and Risk to resolve vulnerabilities and build security automation.

This role requires hands-on execution: identifying risk, validating issues, driving remediation, and verifying that security controls work

Qualifications

• 5+ years of relevant security engineering experience, or equivalent demonstrated delivery in complex environments
• Strong application security and penetration testing skills. Ability to read backend code, identify authentication, authorization, API, and business logic vulnerabilities, and recommend practical fixes
• Hands-on experience with AWS and cloud-native environments, including IAM, Linux, containers, Kubernetes, database access controls, and CI/CD security
• Practical experience using AI/LLM tools, including the ability to explain how they improved your work and recognize incorrect outputs, sensitive data exposure, and excessive permissions
• Ability to work independently within a lean team, prioritize based on business impact, and clearly communicate risks, solutions, and resource needs to technical and nontechnical stakeholders

Responsabilités

• Application Security & Penetration Testing: Conduct security reviews and authorized penetration testing of APIs, authentication, authorization, merchant isolation, and webhooks. Validate business logic vulnerabilities and attack paths, support remediation, and verify fixes.
• Payment & Funds Security: Assess the security of deposits, withdrawals, internal transfers, and wallet or custody integrations. Focus on transaction authorization, request authenticity, duplicate transaction prevention, signing permissions, and approval workflows to identify risks that could enable unauthorized movement of funds.
• Cloud & Infrastructure Security: Partner with DevOps to strengthen security across AWS, Kubernetes, databases, and CI/CD pipelines. Implement least privilege, environment isolation, network access controls, secrets management, and privileged activity auditing.
• Security Engineering & Automation: Integrate code, dependency, secrets, container, and infrastructure configuration checks into development and release workflows. Build security tools and tests, manage false positives, and turn critical business risks into repeatable security checks.
• Security Monitoring & Incident Response: Improve detection rules across cloud, application, and business logs. Lead security investigations and work with relevant teams on containment, remediation, evidence preservation, and post-incident reviews. Establish clear escalation and response procedures.
• AI & Agent Security: Use AI to support code review, threat modeling, vulnerability analysis, test generation, and log investigation while independently validating its outputs. Assess data access, tool permissions, prompt injection, and sensitive actions in the company's AI tools and agents.
• Risk Prioritization & Remediation: Prioritize findings based on exploitability and business impact. Work with Engineering, DevOps/IT, and Risk to establish remediation owners and plans, track issues through resolution, and coordinate external security assessments when needed.

Connaissances

Security engineering

Application security

Penetration testing

AWS

Kubernetes

CI/CD security

AI tools usage

Outils

IAM

Linux

Containers

CI/CD tooling

Description du poste

VelaFi | Global Stablecoin Payments & FinTech Infrastructure

About VelaFi

VelaFi provides global payment and stablecoin infrastructure for businesses, connecting traditional finance with digital assets. We operate with a lean team, a strong engineering mindset, and a practical approach to AI and automation. We are building security capabilities that scale with our global business.

About the Role

We are looking for a hands-on Senior Security Engineer to protect our payment applications, transaction workflows, and cloud infrastructure. You should be able to think like an attacker, work directly with code and systems, and partner with Engineering, DevOps, and Risk to resolve vulnerabilities and build reliable security automation.

This role requires direct technical execution: understanding business risks, identifying and validating critical issues, driving remediation, and verifying that security controls work in practice.

Key Responsibilities

• Application Security & Penetration Testing: Conduct security reviews and authorized penetration testing of APIs, authentication, authorization, merchant isolation, and webhooks. Validate business logic vulnerabilities and attack paths, support remediation, and verify fixes.
• Payment & Funds Security: Assess the security of deposits, withdrawals, internal transfers, and wallet or custody integrations. Focus on transaction authorization, request authenticity, duplicate transaction prevention, signing permissions, and approval workflows to identify risks that could enable unauthorized movement of funds.
• Cloud & Infrastructure Security: Partner with DevOps to strengthen security across AWS, Kubernetes, databases, and CI/CD pipelines. Implement least privilege, environment isolation, network access controls, secrets management, and privileged activity auditing.
• Security Engineering & Automation: Integrate code, dependency, secrets, container, and infrastructure configuration checks into development and release workflows. Build security tools and tests, manage false positives, and turn critical business risks into repeatable security checks.
• Security Monitoring & Incident Response: Improve detection rules across cloud, application, and business logs. Lead security investigations and work with relevant teams on containment, remediation, evidence preservation, and post-incident reviews. Establish clear escalation and response procedures.
• AI & Agent Security: Use AI to support code review, threat modeling, vulnerability analysis, test generation, and log investigation while independently validating its outputs. Assess data access, tool permissions, prompt injection, and sensitive actions in the company's AI tools and agents.
• Risk Prioritization & Remediation: Prioritize findings based on exploitability and business impact. Work with Engineering, DevOps/IT, and Risk to establish remediation owners and plans, track issues through resolution, and coordinate external security assessments when needed.

What We're Looking For

• Typically 5+ years of relevant security engineering experience, or equivalent demonstrated delivery in complex environments, with examples spanning vulnerability discovery, validation, remediation, and retesting.
• Strong application security and penetration testing skills. Ability to read backend code, identify authentication, authorization, API, and business logic vulnerabilities, and recommend practical fixes.
• Hands-on experience with AWS and cloud-native environments, including IAM, Linux, containers, Kubernetes, database access controls, and CI/CD security.
• Practical experience using AI/LLM tools, including the ability to explain how they improved your work and recognize incorrect outputs, sensitive data exposure, and excessive permissions.
• Ability to work independently within a lean team, prioritize based on business impact, and clearly communicate risks, solutions, and resource needs to technical and nontechnical stakeholders.

Preferred Experience

• Experience in payments, FinTech, digital assets, or other security-sensitive environments.
• Knowledge of transaction authorization, ledger integrity, wallet or custody integrations.
• Experience in incident response, vulnerability research, or open-source contributions.
• Experience building security engineering and automation capabilities from the ground up.
• Familiarity with Infrastructure as Code, Policy as Code, or AI agent security.
• Relevant certifications such as OSCP, OSWE, or AWS Certified Security - Specialty are a plus.

VelaFi is an Equal Opportunity Employer committed to fostering a diverse, inclusive, and respectful workplace. We consider all qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by applicable law. We believe diverse backgrounds, experiences, and perspectives strengthen our team and drive innovation. All employment decisions are based on qualifications, skills, experience, and business needs.

We value practical technical ability, sound engineering judgment, and demonstrated results.