Staff Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Report directly to the Chief Information Security Officer (CISO) as an essential security team member.

• Develop Cari's security program from the ground up, enjoying a high degree of autonomy within a small team.

• Implement Single Sign-On (SSO) and automated lifecycle management for joiners, movers, and leavers across both corporate and production systems.

• Design role and entitlement frameworks, conduct regular access reviews, and establish least privilege as the standard.

• Perform threat modeling and enhance the security of Solidity smart contracts, private ZKsync Layer 2 nodes, and custody platform integrations.

• Establish governance protocols for upgrades in on-chain systems.

• Deploy and manage the Security Information and Event Management (SIEM) system, including onboarding and normalizing logs across cloud, identity, endpoint, and application layers.

• Create high-signal detections for authentication abuse, control plane activities, privilege escalations, data movement, and unusual transactions.

• Take ownership of alert quality.

• Act as the technical lead for alerting, vulnerability management, and threat response initiatives.

• Develop containment runbooks, guide investigations through postmortems, and integrate lessons learned back into detection strategies.

• Enforce least-privilege Identity Access Management (IAM), network segmentation, and secrets management across ECS/EKS, MSK, and RDS.

• Create automated security gates within Continuous Delivery (CD) pipelines and developer workflows.

• Implement and document controls for bank-level governance, third-party risk assessments, and compliance audits such as SOC 2 Type II.

• Adhere to Cari’s information security policies and complete mandatory security awareness training.

• Safeguard the confidentiality, integrity, and availability of Cari’s systems and data.

⛳️ Requirements

• Over 8 years of experience in information security, DevSecOps, or infrastructure security.

• Strong ownership in at least two of the following areas, with practical experience in the third: Enterprise IAM; SIEM and detection; AWS security.

• Experience with Enterprise IAM, including SSO, federation, automated user provisioning and deprovisioning, role and entitlement design, and conducting access reviews.

• Proficient in SIEM and detection practices, including deployment, tuning, log onboarding, and detection rule creation.

• Knowledge of AWS security, specifically with ECS or EKS, MSK, RDS, IAM, VPC, and Secrets Manager.

• Familiarity with securing EVM-compatible blockchain or Web3 infrastructure.

• Experience with securing Continuous Delivery pipelines like GitHub Actions or similar, along with containerized workloads.

• Leadership experience in incident response.

• Ability to work autonomously in a small team while building a security program from the ground up.

• Conduct Solidity smart contract reviews, including upgradeable proxies like UUPS and role governance.

• Defensive expertise in Layer 2 solutions, cross-chain bridges, ZK rollups, and EVM transaction mechanics.

• Knowledge of key management, custody APIs, Multi-Party Computation (MPC) signing, or real-time Web3 threat detection and transaction circuit breakers.

• Familiarity with detection-as-code methodologies.

• Proficient in Terraform, including environment auditing and secure baseline codification.

• Understanding of U.S. banking regulations (FFIEC), SOC 2 Type II, or ISO 27001 audits.

• Must reside in the United States.

• Must be legally authorized to work in the United States.

• Must indicate whether future work authorization sponsorship is necessary.

🏝️ Benefits

• Competitive base salary, performance-based bonuses, and equity options.

• Comprehensive medical, vision, and dental benefits.

• 401(k) plan with company matching contributions.

• Flexible paid time off in a remote-first work environment.

• An opportunity to contribute to a market-defining protocol alongside an experienced founding team.