⚡ Security Engineer, Payments Infrastructure
🌍 San Francisco, CA, In-office
💲 $180,000 to $240,000 + Equity + Benefits
The Company
Storm2’s client is a San Francisco-based payments infrastructure company building technology used by businesses ranging from startups through to public companies. Founded in 2015, the business now processes tens of billions of dollars annually across online and in-person payments and has raised more than $200m.
The Role
Payments security gets complicated quickly. Cloud infrastructure, application security, PCI scope, cryptographic keys and the software supply chain all matter, and this role sits across all of them.
You’ll partner directly with engineers on how products are designed and shipped, while owning security across AWS infrastructure and the corporate environment. This isn’t a security role built around producing findings and handing them over. You’ll be expected to understand the problem technically, influence the architecture, and drive remediation through to completion.
The breadth is deliberate. One week could involve reviewing the security model for a new payments feature, the next could mean coordinating a pentest, tightening CI/CD controls, working through PCI architecture or supporting an HSM key operation.
What you’ll be working on:
Partnering with engineering teams on threat modelling, secure design and implementation
Securing AWS infrastructure and employee workstations
Leading security incident response and subsequent remediation
Owning vulnerability management across scanning, pentests and bug bounty findings
Hardening CI/CD pipelines and the wider software supply chain
Working with engineering on PCI architecture, including scope, data handling and secure SDLC
Supporting HSM operations, key exchanges and key injections
Building and maintaining technical controls for PCI DSS and SOC 2
Supporting audit fieldwork and customer security reviews
Defining security controls and guardrails around internal AI tooling
What you’ll bring:
5+ years of hands-on security engineering experience
Strong AWS security experience in a production environment
Software development experience with Java
Experience finding and actually remediating vulnerabilities, not just reporting them
Hands-on incident response experience
Working knowledge of PCI DSS and security controls within regulated environments
Practical cryptography and key-management experience
The ability to communicate security decisions clearly with engineers and non-technical stakeholders
Useful, but not essential:
Terraform, CI/CD security, Okta, CrowdStrike, Palo Alto Prisma Access, Sonatype Nexus, bug bounty or pentesting experience, plus certifications such as AWS Certified Security – Specialty or CISSP.
📧 Click ‘Easy Apply’ or email tudor.simionescu@storm2.com
⚡ Storm2 is a specialist FinTech recruitment firm with clients across North America. Visit storm2.com or follow us on LinkedIn for the latest roles and intel.