Staff Security Engineer

Cari; Oregon; Hybrid; USD 180,000 - 260,000; Full time

Benefits offered by this job

Competitive salary

Medical benefits

401(k)

Job summary

Cari is building a blockchain-based payments platform and seeks a foundational security lead reporting to the CISO. You will own identity, cloud security, and detection across on-chain and off-chain components, guiding a small team to design and implement secure, scalable controls from day one.

You will shape the security program for a real-time, private ZKsync-based L2, drive compliance with SOC 2 Type II, and partner with engineering to bake security into CI/CD, IAM, and incident response.

Qualifications

• 8+ years in information security, DevSecOps, or infrastructure security.
• Deep ownership of at least two areas, with hands-on experience in the third: IAM, SIEM/detection, AWS security.
• Experience securing EVM-compatible blockchain or Web3 infrastructure.
• Experience securing CD pipelines (GitHub Actions or equivalent) and containerized workloads.
• Incident response leadership and high autonomy in a security-build-from-scratch environment.

Responsibilities

• Own identity end to end. Roll out SSO and automated joiner-mover-leaver lifecycle management across corporate and production systems.
• Secure blockchain and signing infrastructure. Harden Solidity contracts, private ZKsync L2 nodes, and custody integrations.
• Build detection from the ground up. Deploy and own SIEM, log onboarding, and detection authoring.
• Lead incident response. Write containment runbooks and drive postmortems.
• Harden AWS. Enforce least-privilege IAM, network segmentation, and secrets management.
• Make security part of shipping. Build automated security gates into CD pipelines and dev workflows.
• Drive compliance readiness. Implement controls for SOC 2 Type II and audits.

Skills

Enterprise IAM

SIEM & detection

AWS security

Tools

GitHub Actions

Terraform

ECS/EKS

Secrets Manager

Job description

About CariThe Cari Network is building a blockchain-based payment system powering real-time, 24/7 movement of digital money across the traditional finance and digital asset ecosystems. A pre-launch startup, we're creating an entirely new category of financial infrastructure that brings cash on chain through tokenization while powering the full spectrum of payments for our network — banks and most importantly, the customers they serve.

About the Role

You'll be a foundational security hire reporting directly to the CISO, building our security program from the ground up with high autonomy on a small team. Our platform processes tokenized bank deposits, turning payment instructions into immutable on-chain records. You'll secure every step of that path: identity, cloud, and detection, through our institutional custody integration, all the way to on-chain finality on our private ZKsync-based L2.

What You'll Do

• Own identity end to end. Roll out SSO and automated joiner-mover-leaver lifecycle management across corporate and production systems. Design the role and entitlement model, run periodic access reviews, and make least privilege the default.
• Secure blockchain and signing infrastructure. Partner with engineering to threat-model and harden our Solidity smart contracts, private ZKsync L2 nodes, and custody platform integrations. Define upgrade governance for on-chain systems.
• Build detection from the ground up. Deploy and own our SIEM, onboarding and normalizing logs across cloud, identity, endpoint, and application layers. Build high-signal detections for authentication abuse, control plane activity, privilege escalation, data movement, and anomalous transactions. You own alert quality, not alert volume.
• Lead incident response. Serve as technical lead for alerting, vulnerability management, and threat response. Write containment runbooks, drive investigations through postmortem, and feed lessons back into detection.
• Harden AWS. Enforce least-privilege IAM, network segmentation, and secrets management across ECS/EKS, MSK, and RDS.
• Make security part of shipping. Build automated security gates into CD pipelines and developer workflows, so security keeps pace with delivery.
• Drive compliance readiness. Work with the CISO to implement and document controls for bank-level governance, third-party risk, and audits such as SOC 2 Type II.

Qualifications

• 8+ years in information security, DevSecOps, or infrastructure security.
• Deep ownership of at least two of these areas, with hands-on experience in the third:
  • Enterprise IAM: SSO, federation, automated provisioning and deprovisioning, role and entitlement design, and access reviews.
  • SIEM and detection: deployment, tuning, log onboarding, and detection authoring. You can point to detections you've written and explain how you kept them useful.
  • AWS security: ECS or EKS, MSK, RDS, IAM, VPC, and Secrets Manager.
• Experience securing EVM-compatible blockchain or Web3 infrastructure.
• Experience securing CD pipelines (GitHub Actions or equivalent) and containerized workloads.
• Incident response leadership.
• Comfort working with high autonomy on a small team building a security program from scratch.

Nice to Haves

• Solidity smart contract reviews, including upgradeable proxies (such as UUPS) and role governance.
• Defensive knowledge of L2s, cross-chain bridges, ZK rollups, and EVM transaction mechanics (ABI encoding, calldata validation, nonce management, event log integrity).
• Key management, custody APIs (Fireblocks, Turnkey, Fordefi), MPC signing, or real-time Web3 threat detection and transaction circuit breakers.
• Detection-as-code: version-controlled, tested detections mapped to a framework.
• Terraform, including auditing environments and codifying secure baselines.
• U.S. banking regulation (FFIEC), or SOC 2 Type II and ISO 27001 audits.

What We Offer

• Competitive base salary, bonus, and equity
• Full medical, vision, dental benefits
• 401(k) with company matching
• Flexible PTO in a remote-first environment
• Opportunity to shape a market-defining protocol with an experienced founding team

Security Responsibilities

Applies to all Cari employees

• Comply with all Cari information security policies, including the Acceptable Use Policy, and complete required security awareness training.
• Protect the confidentiality, integrity, and availability of Cari systems and data, including bank-partner and customer information, consistent with least-privilege access principles.