[Hiring] Security Engineer @Block

Role Description

Square Financial Services, Inc. (SFS) is Block’s bank. We opened in March 2021 and provide lending and FDIC-insured deposit products to individuals and small businesses on a nationwide basis.

SFS Risk Management is scaling vendor security, third party risk, and business continuity through innovation. Our Risk team designs and promotes the frameworks, standards, and oversight that elevate security considerations among our vendors, simplify our regulatory obligations, and ensure resilience in our business operations. The team also operates the agent-first platforms that turn those frameworks into running systems.

Most of governance is a data problem. The risk, control, and asset information needed to answer "are we secure and compliant?" is dispersed across dozens of systems: Security Engineers treat that as an engineering problem. You'll build the data pipelines, integrations, and agentic AI workflows that turn manual governance processes into products that run continuously, produce measurable results, and hold up to audit end to end.

You Will:

• Own and operationalize a SFS third-party risk management and business continuity program.
• Define the technical approach for ambiguous, cross-team problem spaces.
• Build and operate the pipelines and integrations that aggregate, normalize, and join risk, control, and asset signals from systems of record across Block and SFS.
• Translate standards and compliance requirements into policy-as-code.
• Design agentic AI workflows that pair LLM reasoning with deterministic, auditable decision layers.
• Automate evidence collection and continuous control monitoring.
• Partner with Security, Procurement, Resilience, and Engineering teams.
• Contribute to technical design discussions, evaluating the security and reliability properties of the platform.

Qualifications

• Third-party risk management and business continuity experience.
• 4+ years building production software in backend, platform, data, or software engineering.
• Multi-year ownership of a production system, including on-call, SLOs, and maintenance work.
• Proficiency with at least one of Python, Kotlin, Java, or Go.
• Hands-on experience building with LLMs and opinions about model judgment.
• Experience with integration patterns: REST APIs, webhooks, authentication flows, event-driven architectures.
• Experience pulling, normalizing, and joining data from multiple sources.
• Experience defining technical direction in ambiguous situations.
• Attention to detail balanced with pragmatism about risk-based prioritization.
• Curiosity, persistence, and comfort operating with minimal structure.

Requirements

• Working knowledge of a security or compliance framework such as PCI DSS, SOX, SOC 2, ISO 27001, or NIST (nice to have).
• Production-scale LLM or agentic systems experience (nice to have).

Benefits

• Remote work.
• Medical insurance.
• Flexible time off.
• Retirement savings plans.
• Modern family planning.