Senior Security Engineer

Collections today works like an emergency room. The doctors carry too many patients, everyone arrives at their worst moment, and nobody has their chart. We're making it primary care. January personalizes interactions and optimizes decisions across every stage of consumer credit. We started in the hardest, most broken stage, because if it works there it works anywhere.

Most consumers want to pay what they owe. They want a way out, not a break. We've serviced over $20 billion in debt across more than 20 million consumers. We see more people with charged-off loans each year than all but the top five US banks. Those consumers rate us about 50% higher than the banks that lent them the money. Creditors net over 30% more because we collect more and charge less.

Most AI strips the human out of the work. We use it to make someone's hardest financial moment more human. The more human we make it, the more people recover. Now we're moving upstream, catching people before they default and building across every stage of the consumer credit lifecycle. The consumer in collections today is the consumer who gets approved tomorrow.

About the Role

As our first in-house Senior Security Engineer, you'll own the question every bank asks before it trusts us with its borrowers: who can reach this data, and how do you know? You'll set the standard for identity and access control across a platform that handles regulated financial data for banks, credit unions, and fintech lenders, in an environment where AI agents work alongside engineers. The work decides whether security is the reason a Tier-1 bank signs, or the reason it doesn't.

You will:

Own identity and access control across AWS (IAM, Identity Center), Okta, and the data tier (Postgres, Snowflake): tenant isolation for regulated data, least-privilege service identities, and access patterns that hold up to bank-grade review.

Harden the platform with the DevX/SRE team: Terraform reviews, CI/CD supply-chain controls, secrets management, and the guardrails for AI coding agents in the development workflow.

Make compliance a byproduct of good engineering. We're mid-flight on PCI DSS Level 1 and SOC 2 Type II. You'll build controls that generate their own evidence instead of quarterly scrambles.

Be the technical authority on client security reviews. Bank and fintech clients send us due diligence questionnaires. You make sure our answers are accurate, defensible, and fast, because they gate revenue.

Move the function from reactive to proactive: a vulnerability management program, a roadmap engineering can plan against, and written trade-offs that let teams decide without you in the room.

Set technical direction for a function that today runs on two full-time security contractors plus an IT lead. You'll report to the Engineering Manager for DevX & Security.

What We Need

Technical excellence in identity and infrastructure security. You've designed access models and tenant isolation for sensitive data in a cloud environment, and you reason in blast radius: what a leaked credential actually reaches, and where the boundary is enforced.

Ownership. You've been the person who built the security foundation somewhere, not the person who inherited it. You find the problem nobody owns and drive it without being asked.

Prioritization under uncertainty. You triage by exploitability and impact, not severity labels. You can name what you're not doing this week and defend it later.

Truth-seeking. You verify claims instead of accepting them, own it when you're wrong, and answer a client questionnaire honestly even when the honest answer is a gap.

Influence without authority. You make security the easy path for engineers and translate trade-offs into language a PM or an executive acts on.

Communication. You write clearly. Your assessments, incident summaries, and questionnaire responses can be forwarded as-is.

4+ years in security engineering , with hands-on depth in AWS, infrastructure-as-code, and Python. Experience with SOC 2, PCI DSS, or bank security standards is a plus: enough to design against them, not to run the program.

How We Work

Decentralization beats control. The best calls get made by the people closest to them, not routed up a chain. You'll set the standards that let the team decide without you in the room.

Speed beats perfection. You run tight loops, act at 70% on reversible calls and adjust as you learn. Fast loops beat slow ones.

Candor beats comfort. You'd rather hear a hard truth early than a polite sidestep that wastes everyone's time.

Writing beats the average meeting . Clarity scales.

AI runs through everything here. 95% of our consumer interactions are AI-driven. Internally, we've built an LLM code reviewer and approver. We benchmark coding agents against real tickets so we can automate more of them. Over the last six months, Engineering has doubled how much we can ship. Non-technical teams are just as fluent in AI - anyone can spin up a custom LLM Slackbot, and everyone consistently builds AI tools and skills that are shipped org-wide.

We operate at every altitude. No one here lives only on Mount Olympus, not even the leaders. We get into the trenches to learn the ground truth. We constantly refine our information flows so that our decisions are driven by the best, most up to date inputs.

We build in person, at least three days a week in our office in Nolita , with a growing group coming in every day. Random run-ins cross-pollinate ideas. Face time builds trust no thread can. Building alongside people makes work far more fun.

As a New York City-based company, we are dedicated to transparent, fair, and equitable compensation practices that reflect our commitment to fostering an environment where all team members are valued and supported. We encourage individuals from all backgrounds to apply.

We are an equal opportunity employer committed to diversity and inclusion in the workplace. We do not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, age, veteran status, or any other legally protected characteristic.