Own the security model for our partner-facing APIs: authentication, authorization, tenant isolation, abuse prevention, signing, and audit logging.

Drive a coherent auth strategy across services and surfaces, including step-up auth for sensitive actions and a strong-auth roadmap (passkeys and beyond).

Build the device telemetry, behavioral signals, and velocity primitives that fraud and risk functions depend on.

Be the secure-by-design partner with Engineering — sit in on architecture reviews before features ship, write the threat models, own the tradeoffs.

Own secure SDLC: SAST/DAST, dependency scanning, secret detection, and the security tooling engineers interact with daily.

Coordinate with our infrastructure team to improve our security posture across the stack: from infrastructure, to supply chain, to first-party applications, to third-party dependencies and SaaS platforms.

Be the technical authority on sensitive payment data. Keep the footprint small and well-defined as the platform grows.

Lead incident response on security events (containment, forensics, comms, blameless postmortems) and drive vulnerability remediation across services.

Own the relationship with our external security architecture partner: set priorities, scope engagements, integrate findings into our roadmap.

Serve as the technical counterpart to ensure compliance, translating SOC 2, PCI DSS, and other security frameworks into scalable engineering solutions and ensuring in-product controls are effective in practice - not just on paper.

What we look for

Strong programming skills in Java, Python, or a comparable language — you write production code.

Security Engineer - Product

Responsibilities

Qualification

Preferred

Benefits

Company

Cardless

More roles at Cardless