[Hiring] Staff Security Engineer @Cari

Role Description

You'll be a foundational security hire reporting directly to the CISO, building our security program from the ground up with high autonomy on a small team. Our platform processes tokenized bank deposits, turning payment instructions into immutable on-chain records. You'll secure every step of that path: identity, cloud, and detection, through our institutional custody integration, all the way to on-chain finality on our private ZKsync-based L2.

What You'll Do

• Own identity end to end.
• Roll out SSO and automated joiner-mover-leaver lifecycle management across corporate and production systems.
• Design the role and entitlement model, run periodic access reviews, and make least privilege the default.
• Secure blockchain and signing infrastructure.
• Partner with engineering to threat-model and harden our Solidity smart contracts, private ZKsync L2 nodes, and custody platform integrations.
• Define upgrade governance for on-chain systems.
• Build detection from the ground up.
• Deploy and own our SIEM, onboarding and normalizing logs across cloud, identity, endpoint, and application layers.
• Build high-signal detections for authentication abuse, control plane activity, privilege escalation, data movement, and anomalous transactions.
• You own alert quality, not alert volume.
• Lead incident response.
• Serve as technical lead for alerting, vulnerability management, and threat response.
• Write containment runbooks, drive investigations through postmortem, and feed lessons back into detection.
• Harden AWS.
• Enforce least-privilege IAM, network segmentation, and secrets management across ECS/EKS, MSK, and RDS.
• Make security part of shipping.
• Build automated security gates into CD pipelines and developer workflows, so security keeps pace with delivery.
• Drive compliance readiness.
• Work with the CISO to implement and document controls for bank-level governance, third-party risk, and audits such as SOC 2 Type II.

Qualifications

• 8+ years in information security, DevSecOps, or infrastructure security.
• Deep ownership of at least two of these areas, with hands-on experience in the third:
• Enterprise IAM: SSO, federation, automated provisioning and deprovisioning, role and entitlement design, and access reviews.
• SIEM and detection: deployment, tuning, log onboarding, and detection authoring. You can point to detections you've written and explain how you kept them useful.
• AWS security: ECS or EKS, MSK, RDS, IAM, VPC, and Secrets Manager.
• Experience securing EVM-compatible blockchain or Web3 infrastructure.
• Experience securing CD pipelines (GitHub Actions or equivalent) and containerized workloads.
• Incident response leadership.
• Comfort working with high autonomy on a small team building a security program from scratch.

Nice to Haves

• Solidity smart contract reviews, including upgradeable proxies (such as UUPS) and role governance.
• Defensive knowledge of L2s, cross-chain bridges, ZK rollups, and EVM transaction mechanics (ABI encoding, calldata validation, nonce management, event log integrity).
• Key management, custody APIs (Fireblocks, Turnkey, Fordefi), MPC signing, or real-time Web3 threat detection and transaction circuit breakers.
• Detection-as-code: version-controlled, tested detections mapped to a framework.
• Terraform, including auditing environments and codifying secure baselines.
• U.S. banking regulation (FFIEC), or SOC 2 Type II and ISO 27001 audits.

Benefits

• Competitive base salary, bonus, and equity.
• Full medical, vision, dental benefits.
• 401(k) with company matching.
• Flexible PTO in a remote-first environment.
• Opportunity to shape a market-defining protocol with an experienced founding team.

Security Responsibilities

• Comply with all Cari information security policies, including the Acceptable Use Policy, and complete required security awareness training.
• Protect the confidentiality, integrity, and availability of Cari systems and data, including bank-partner and customer information, consistent with least-privilege access principles.