Software Engineer - Risk

cardless; San Francisco (CA); On-site; USD 190,000 - 295,000; Full time

Benefits offered by this job

Startup equity

Health insurance

Dental coverage

Vision coverage

Commuter benefit

Parental leave

Team events

Flexible PTO

Apple equipment

401k plan

Job summary

Cardless in San Francisco is seeking a senior to staff Risk Engineer to own the risk decisioning layer for payments, device trust, and transactions. You’ll build an in-house risk platform with versioned rules, kill switches, and real-time visibility alongside Risk and Fraud Operations.

You’ll champion end-to-end security, incident readiness, and rapid turn-off of faulty rules, while shaping the platform architecture for future teams.

Qualifications

• 6+ years building production backend systems in fraud, payments risk, or trust domains.
• Built risk systems as an engineer: decisioning services, rules engines, real-time scoring.

Responsibilities

• Build the risk decisioning layer for card authorization and mobile wallet provisioning.
• Move fraud logic from vendor dashboards into a testable control plane with shadow mode and kill switches.
• Build real-time detection and alerting across velocity, cross-provisioning, and device signals.
• Gate servicing changes on risk evaluation and ship the fraud-analyst tools.

Skills

Backend systems

Fraud risk

Distributed systems

API design

Java

Python

Tools

Java

Python

APIs

Job description

Cardless is building the infrastructure for the world's best companies to design, build, and launch financial products of their own. Companies like Coinbase and Bilt use Cardless to create credit cards that feel entirely their own. In an industry where branded financial products usually mean shared logos and shared control, Cardless is built to disappear. Our APIs and components shape the journey from the first application to every purchase, reward, and moment of support that follows, while we handle lending, compliance, and operations behind the scenes.

In September 2025, we raised a $60 million Series C led by Spark Capital, bringing our total funding to $170 million. The team is over 70 people and scaling toward profitability by year-end 2026.

We're looking for kind, humble people with high standards and low egos. We take the work seriously without taking ourselves too seriously. We see what could be improved, make it so, and leave every product, system, and team better than we found it.

About the role

As a Risk Engineer at Cardless, you'll own the systems that decide whether to trust a person, a device, or a transaction.

We're bringing fraud decisioning in-house. Much of it runs through vendor platforms today, which serve us well but leaves the decisions, the tuning, and the visibility outside systems we control. You'll build that layer: risk rules as versioned code, controls with kill switches, and detection our analysts can watch in real time. This is a senior-to-staff role with real architectural ownership, working directly with our Risk and Fraud Operations teams.

What you’ll do

• Build the risk decisioning layer for card authorization and mobile wallet provisioning: what gets approved, stepped up, or frozen

• Move fraud logic out of vendor dashboards into one testable control plane, with shadow mode, staged rollout, and kill switches

• Build real-time detection and alerting across velocity, cross-provisioning, and device signals, plus a lockdown posture for active attacks

• Gate servicing changes (address, phone, email, reship) on risk evaluation, and ship the tooling our fraud analysts work in daily

What we’re looking for

• 6+ years building production backend systems, with meaningful time in fraud, payments risk, or trust and safety engineering

• You've built risk systems as an engineer: decisioning services, rules engines, real-time scoring, step-up orchestration. Not analyzing fraud or handing models off for someone else to deploy

• Strong distributed systems and API fundamentals in a modern backend language (we're primarily Java, with Python for data work)

• You think in blast radius: what if this rule is wrong, how fast can we turn it off, how will we know? And you're steady in an incident

Bonus Points

• Card issuing: auth-time decisioning, tokenization, wallet provisioning, disputes, and PCI knowledge would all be huge pluses

• Account takeover and step-up auth: OTP, SIM swap, phishing resistance, device fingerprinting, passkeys, IDV

• You've worked at a risk or identity vendor (Sardine, Sift, Unit21, Feedzai, Alloy, Persona) and want the issuer side

This role isn't a fit if

• You want to build models rather than the systems that run them

• You'd rather tune an established platform than design one

• You want clean separation from operations, or to work remotely

Why this role

Fraud is one of the few problems in fintech where the adversary adapts to you personally, in days, and one of the few where good engineering is immediately impactful. You can watch a control go live and watch the losses stop as fast as you can ship.

We’re looking for the founding risk engineer who we can eventually build the team around at Cardless. You'll decide what the platform is, what belongs in code versus vendor config, and what "defended" means here across every brand we launch. The second-order effect is a better product: tighter controls, done well, mean fewer false positives and less friction for the customers who deserve none.

Compensation

This role has an annual starting salary range of $190,000 - $295,000 + equity + benefits (see below). Actual compensation is influenced by a wide array of factors including but not limited to skills, experience, and specific work location.

Benefits

Meaningful Start-up equity

100% health, vision & dental primary coverage

75% health, vision & dental dependent coverage

Catered lunches

$250/month Commuter benefit

Parental leave

Team building events & happy hours

Flexible PTO with a minimum of 15 days off per year

Apple equipment

401k plan

Location

San Francisco, CA — our office is in the Jackson Square district. This role is 5 days a week in office.