Senior Security Engineer

⚡ Security Engineer, Payments Infrastructure

🌍 San Francisco, CA, In-office

💲 $180,000 to $240,000 + Equity + Benefits

The Company

Storm2’s client is a San Francisco-based payments infrastructure company building technology used by businesses ranging from startups through to public companies. Founded in 2015, the business now processes tens of billions of dollars annually across online and in-person payments and has raised more than $200m.

The Role

Payments security gets complicated quickly. Cloud infrastructure, application security, PCI scope, cryptographic keys and the software supply chain all matter, and this role sits across all of them.

You’ll partner directly with engineers on how products are designed and shipped, while owning security across AWS infrastructure and the corporate environment. This isn’t a security role built around producing findings and handing them over. You’ll be expected to understand the problem technically, influence the architecture, and drive remediation through to completion.

The breadth is deliberate. One week could involve reviewing the security model for a new payments feature, the next could mean coordinating a pentest, tightening CI/CD controls, working through PCI architecture or supporting an HSM key operation.

What you’ll be working on:

Partnering with engineering teams on threat modelling, secure design and implementation

Securing AWS infrastructure and employee workstations

Leading security incident response and subsequent remediation

Owning vulnerability management across scanning, pentests and bug bounty findings

Hardening CI/CD pipelines and the wider software supply chain

Working with engineering on PCI architecture, including scope, data handling and secure SDLC

Supporting HSM operations, key exchanges and key injections

Building and maintaining technical controls for PCI DSS and SOC 2

Supporting audit fieldwork and customer security reviews

Defining security controls and guardrails around internal AI tooling

What you’ll bring:

5+ years of hands-on security engineering experience

Strong AWS security experience in a production environment

Software development experience with Java

Experience finding and actually remediating vulnerabilities, not just reporting them

Hands-on incident response experience

Working knowledge of PCI DSS and security controls within regulated environments

Practical cryptography and key-management experience

The ability to communicate security decisions clearly with engineers and non-technical stakeholders

Useful, but not essential:

Terraform, CI/CD security, Okta, CrowdStrike, Palo Alto Prisma Access, Sonatype Nexus, bug bounty or pentesting experience, plus certifications such as AWS Certified Security – Specialty or CISSP.

📧 Click ‘Easy Apply’ or email tudor.simionescu@storm2.com

⚡ Storm2 is a specialist FinTech recruitment firm with clients across North America. Visit storm2.com or follow us on LinkedIn for the latest roles and intel.