Senior Security Engineer

Job description

Collections runs like an emergency room. You show up in crisis, get triaged by a stranger who doesn't know your history and leave with no follow-up. We're turning it into primary care for consumer finance. We started in the hardest, most broken stage, because if it works there it works anywhere. 70 million Americans fall behind on a debt every year. Most want to pay what they owe and can't find a way back. We've serviced over $20 billion in debt across more than 20 million consumers. We see more people with charged-off loans each year than all but the top five US banks. They rate us about 50% higher than the banks that lent them the money. Creditors net over 30% more with us because we collect more and charge less. Most AI strips the human out of the work. We use it to do the opposite. In someone's hardest financial moment we make the experience more human. The more human we make it, the more people recover. Now we're moving upstream, catching people before they default and building across every stage of the consumer credit lifecycle. The consumer in collections today is the consumer who gets approved tomorrow. ABOUT THE ROLE As a Senior Security Engineer, you'll set a new standard for security in an industry where trust is profoundly broken. Join at a rare inflection point: we've earned the hard-fought trust of leading financial institutions, and now you'll build the security foundation that scales this trust to tens of millions of consumers. You'll architect dual trust — securing both consumer-facing experiences and bank-grade enterprise systems — while solving technical challenges that exist nowhere else: privacy-preserving data systems, multi-jurisdiction compliance automation, and AI-enabled decisioning. You'll shape security strategy and culture from the ground up with direct influence on company direction, proving your security work isn't overhead. It's the competitive moat that unlocks enterprise partnerships and enables market expansion. YOUR IMPACT - Embed security as a competitive advantage: Transforms January's security into product capabilities that banks choose us for, not just a compliance checkbox they tolerate. Unlocks Tier 1 partnerships and enterprise deals competitors can't close. - Drive security-by-design across product and application development: Partners with product and engineering to identify and elevate critical risks before production, with deep focus on application security (frontend, Flask services, database). Embeds security into discovery and design while building secure-by-default patterns into development workflows. Accelerates product development through early engagement and clear guidance, not late-stage gate-keeping. - Architect systems for bank-grade data protection: Designs and implements data classification, encryption, and access control meeting regulated client requirements. Establishes automated controls ensuring sensitive data never leaves authorized boundaries. - Cultivate a security-first engineering culture: Influences engineering teams to adopt security-first thinking without sacrificing velocity. Leads incident response with clarity and urgency, ensuring January emerges from security events stronger through rigorous post-mortems. - Scale compliance with minimal overhead: Maintains SOC 2, PCI-DSS, and financial compliance through automated systems. Builds infrastructure that auto-generates audit evidence and eliminates compliance bottlenecks. QUALIFICATIONS - 6+ years in cybersecurity, 3+ years in application/data security or security engineering - Hands-on building application-level security controls in cloud environments (AWS, Terraform, Snowflake) - Track record implementing security that accelerates velocity, not blocks it - Technical depth: secure coding (Python, JavaScript), infrastructure-as-code, CI/CD security - Influences through partnership, decides rapidly despite uncertainty - Translates technical trade-offs into business language - Proficiency in common scripting and programming languages, such as Python, JavaScript, and Bash, is strongly preferred. - Experience with compliance frameworks (SOC 2, PCI-DSS, bank security standards) preferred. HOW WE WORK - Decentralization beats control. The best calls get made by the people closest to them, not routed up a chain. You'll set the standards that let the team decide without you in the room. - Speed beats perfection. You run tight loops, act at 70% on reversible calls and adjust as you learn. Fast loops beat slow ones. - Candor beats comfort. You'd rather hear a hard truth early than a polite sidestep that wastes everyone's time. - Writing beats the average meeting. Clarity scales. - AI runs through everything here. We built our own code reviewer that beats the alternatives. Our voice AI handles most inbound calls with zero hallucinated payments. Engineers ship 3-4x the PRs they used to. You'll push it further into the work than almost any company you've worked at. - We operate at every altitude. No one here lives only on Mount Olympus, not even the leaders. We get into the trenches to learn the ground truth, then refine our information flows so ground truth climbs as fast as direction comes down. - We build in person, at least three days a week in our office in Nolita, with a growing group coming in every day. Random run-ins cross-pollinate ideas. Face time builds trust no thread can. Building alongside people makes work far more fun. We are currently hiring for this position in our New York office. As a New York City-based company, we are dedicated to transparent, fair, and equitable compensation practices that reflect our commitment to fostering an environment where all team members are valued and supported. We encourage individuals from all backgrounds to apply. We are an equal opportunity employer committed to diversity and inclusion in the workplace. We do not discriminate based on race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, age, veteran status, or any other legally protected characteristic.