Senior Engineering Manager, Security

Stay Hands-On : Write detection rules, review PRs, file hardening commits, and threat-model features alongside engineering teams. If you've been pushed into pure management and miss building, this role gives you permission to get back to it while still setting strategic direction.

AI-Native Security : Build security capabilities using AI agents for detection triage, compliance automation, and dependency management. You'll secure AI products and use AI to multiply your own leverage. This is how a small team operates at the standards of a company 10x its size.

Full-Stack Ownership : Own the entire security domain: application security, cloud infrastructure, detection engineering, and AI governance.

Preventative, Not Reactive : Build security that scales with the business rather than firefighting inherited problems. Do it right from the start, before bad patterns harden.

Series D Sweet Spot : We have product-market fit and real traction, but we're still small enough for you to shape everything. Your decisions will drive our security posture for years to come.

High-Trust Domain : Co-branded credit cards in regulated fintech (PCI, SOC 2, ISO). Security isn't a tax here; it's what enables every partner launch and every customer interaction.

AI security: threat-model Imprint's agent surfaces for prompt injection, tool misuse, and authorization boundaries.

AI for security: build AI-native capabilities that scale a small team's impact: AI-powered detection triage, automated compliance evidence collection, and threat-modeling assistance.

Application security: threat modeling for new features, secure code review, SAST/SCA/DAST in CI, SDL design, dependency management, and secrets management. You read Go and TypeScript well enough to review PRs and catch the bugs that external audits should not have to find.

Cloud and infrastructure security: IAM partitioning across multiple AWS accounts, least-privilege access, JIT elevation, cross-account trust hardening, KMS boundaries, SCP design, Kubernetes pod security, egress filtering, and Terraform security review.

Detection and response: build the SIEM/SOAR pipeline from log sources through triage, write correlation rules, enable AI-powered triage, stand up on-call rotation, and create incident response runbooks.

Identity and access: drive SSO coverage, access reviews, and JIT elevation in partnership with IT.

Compliance partnership: design and implement the controls that satisfy SOC 2, PCI, and ISO evidence requirements. GRC runs the audit cycle. You own the underlying controls and make sure they actually hold up, not just pass sampling.

Partner and customer trust: lead technical responses to third-party questionnaires and partner security reviews alongside GRC.

Experience as the first or early security hire at a high-growth fintech or marketplace

Background at companies like Ramp, Mercury, Stripe, Whatnot, or similar fast-scaling environments

Experience securing AI and ML systems, model pipelines, or AI-assisted development workflows

Familiarity with card issuing, payment processing, or financial services infrastructure

Terraform and Helm fluency with hands-on CI/CD security integration experience

Open source contributions, security research, or conference speaking

If you've built something real in security and want to do it again, we want to talk.