Senior Security Engineer – Fintech Payments (SF On-site)

Storm2; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Storm2 in San Francisco is seeking a Senior Security Engineer to own our security function across infrastructure, applications, and operations. You will partner with software teams to embed security into design and development of payments platforms that handle high-volume transactions.

You will secure AWS environments, lead incident response, oversee penetration testing and vulnerability management, and drive secure SDLC, cryptography and key management, PCI DSS and SOC 2 compliance.

Qualifications

• 5+ years of experience in Security Engineering, ideally within fintech, payments, or cloud-native environments.
• Strong hands-on experience securing AWS environments, including security tooling and infrastructure.
• Software development experience with Java.
• Demonstrable experience identifying and remediating security vulnerabilities.
• Hands-on experience with security incident response.
• Knowledge of PCI DSS and other security/regulatory frameworks.
• Experience with cryptography, HSMs, or key management.
• Strong written and verbal communication skills, with ability to communicate risks to technical and non-technical stakeholders.
• Experience with CI/CD security, Infrastructure as Code (Terraform), IAM, identity providers, penetration testing, or bug bounty programs is advantageous.
• Relevant security certifications such as CISSP or AWS Security Specialty are a plus.

Responsibilities

• Partner closely with Software Engineering teams to embed security into design and development of new products and features.
• Secure and improve the company's AWS infrastructure, endpoints, and broader technology environment.
• Lead and support security incident response, including investigation, remediation, and preventative measures.
• Manage security testing initiatives, including penetration testing, vulnerability scanning, and bug bounty programs.
• Triage security findings and drive remediation with engineering teams.
• Strengthen security of CI/CD pipelines and the software supply chain.
• Help define secure architecture around payments, sensitive data, and the SDLC.
• Support HSM operations, cryptographic key management, exchanges, and injections.
• Build and maintain security controls supporting PCI DSS, SOC 2, and other frameworks.
• Support security audits and respond to customer requirements.
• Help secure internal AI tooling and establish guardrails around AI use.

Skills

Security engineering

AWS security

Incident response

CI/CD security

Java development

Communication

Regulatory compliance

Cryptography / HSMs

Vulnerability management

Bug bounty awareness

Tools

AWS Security Hub

Terraform

Key management tools

Job description

Storm2 in San Francisco is seeking a Senior Security Engineer to own our security function across infrastructure, applications, and operations. You will partner with software teams to embed security into design and development of payments platforms that handle high-volume transactions.

You will secure AWS environments, lead incident response, oversee penetration testing and vulnerability management, and drive secure SDLC, cryptography and key management, PCI DSS and SOC 2 compliance.