Senior Security Engineer: Apps, Cloud & Automation

VelaFi; Dallas (TX); Presencial; USD 120.000 - 190.000; Jornada completa

Descripción de la vacante

VelaFi is a fast-growing FinTech infrastructure provider seeking a hands-on Senior Security Engineer to protect our payment applications, transaction workflows, and cloud infrastructure. You will think like an attacker, work directly with code and systems, and partner with Engineering, DevOps, and Risk to resolve vulnerabilities and build security automation.

This role requires hands-on execution: identifying risk, validating issues, driving remediation, and verifying that security controls work

Formación

• 5+ years of relevant security engineering experience, or equivalent demonstrated delivery in complex environments
• Strong application security and penetration testing skills. Ability to read backend code, identify authentication, authorization, API, and business logic vulnerabilities, and recommend practical fixes
• Hands-on experience with AWS and cloud-native environments, including IAM, Linux, containers, Kubernetes, database access controls, and CI/CD security
• Practical experience using AI/LLM tools, including the ability to explain how they improved your work and recognize incorrect outputs, sensitive data exposure, and excessive permissions
• Ability to work independently within a lean team, prioritize based on business impact, and clearly communicate risks, solutions, and resource needs to technical and nontechnical stakeholders

Responsabilidades

• Application Security & Penetration Testing: Conduct security reviews and authorized penetration testing of APIs, authentication, authorization, merchant isolation, and webhooks. Validate business logic vulnerabilities and attack paths, support remediation, and verify fixes.
• Payment & Funds Security: Assess the security of deposits, withdrawals, internal transfers, and wallet or custody integrations. Focus on transaction authorization, request authenticity, duplicate transaction prevention, signing permissions, and approval workflows to identify risks that could enable unauthorized movement of funds.
• Cloud & Infrastructure Security: Partner with DevOps to strengthen security across AWS, Kubernetes, databases, and CI/CD pipelines. Implement least privilege, environment isolation, network access controls, secrets management, and privileged activity auditing.
• Security Engineering & Automation: Integrate code, dependency, secrets, container, and infrastructure configuration checks into development and release workflows. Build security tools and tests, manage false positives, and turn critical business risks into repeatable security checks.
• Security Monitoring & Incident Response: Improve detection rules across cloud, application, and business logs. Lead security investigations and work with relevant teams on containment, remediation, evidence preservation, and post-incident reviews. Establish clear escalation and response procedures.
• AI & Agent Security: Use AI to support code review, threat modeling, vulnerability analysis, test generation, and log investigation while independently validating its outputs. Assess data access, tool permissions, prompt injection, and sensitive actions in the company's AI tools and agents.
• Risk Prioritization & Remediation: Prioritize findings based on exploitability and business impact. Work with Engineering, DevOps/IT, and Risk to establish remediation owners and plans, track issues through resolution, and coordinate external security assessments when needed.

Conocimientos

Security engineering

Application security

Penetration testing

AWS

Kubernetes

CI/CD security

AI tools usage

Herramientas

IAM

Linux

Containers

CI/CD tooling

Descripción del empleo

VelaFi is a fast-growing FinTech infrastructure provider seeking a hands-on Senior Security Engineer to protect our payment applications, transaction workflows, and cloud infrastructure. You will think like an attacker, work directly with code and systems, and partner with Engineering, DevOps, and Risk to resolve vulnerabilities and build security automation.

This role requires hands-on execution: identifying risk, validating issues, driving remediation, and verifying that security controls work