Lead Security and Infrastructure Engineer

Rise Works•,

9d•$180,000 - $210,000•Remote

About The Position

Rise is a global payments and payroll platform built for the way modern teams actually work - across borders, currencies, and rails. We make it possible for companies to pay full-time employees, contractors, and freelancers anywhere in the world, in either fiat or digital assets, with the compliance, tax, and identity infrastructure handled underneath. Our stack runs on Google Cloud Platform (Cloud Run, BigQuery), with MySQL, a Node.js / TypeScript application layer, and Cloudflare (including Cloudflare Pages) at the edge, plus Ethereum-based settlement for stablecoin payments. Because we move money for real people, security and correctness are first-order concerns in everything we ship. We're a lean, high-trust, high-ownership team. Because we move real money for real people, we hold a high bar for correctness, security, and accountability - the work is meaningful precisely because the stakes are real. We value: Ownership over hand-offs. You'll own security and infrastructure end to end and have the autonomy that comes with that. Security as a default, not a phase. Handling funds and personal data means security thinking is part of every decision, not a box checked at the end. Directness and low ego. We give and receive candid feedback, write things down, and prefer clarity over politics. Remote-first discipline. We're a globally distributed team spread across time zones around the world, and we communicate asynchronously with a bias toward documentation and reproducibility.

Requirements

Authorized to work in the United States and U.S.-based.
8+ years in security engineering, with enough ownership and judgment to set direction as the founding security hire.
Deep, hands-on cloud security experience, ideally Google Cloud Platform (IAM, networking, logging/monitoring, SecOps, Security Command Center) - strong AWS or Azure depth with a willingness to go deep on GCP also works.
Strong security fundamentals: IAM and least privilege, secrets/key management, network security, cryptography basics, and data protection.
Demonstrated application security capability: threat modeling, secure code review, and vulnerability management in a modern web/API stack.
Proven incident-response track record - you've been in the room when something was on fire and helped put it out.
Detection engineering instincts: you can turn logs into signal and signal into alerts that people act on.
Comfort reading and reasoning about code in a Node.js / TypeScript and MySQL environment (you don't need to be a full-time developer).
Hands-on CI/CD and infrastructure-as-code experience - you can own deployment pipelines and embed security controls into how we build and ship.
Willingness to carry production operations and on-call for a small set of VMs and a mostly serverless GCP footprint alongside the security work.
SOC 2 experience - you've been through an audit and know what evidence collection actually costs.

Nice To Haves

Experience in fintech, payments, or another regulated, funds-handling environment.
ISO 27001 or PCI DSS experience.
Security certifications (e.g., CISSP, OSCP, GCP Professional Cloud Security Engineer).
Curiosity about digital-asset payments - we settle in both fiat and stablecoins, so there's plenty to learn here, but no prior blockchain experience is required.

Responsibilities

Own Rise's security posture across cloud, application, and data surfaces.
Enforce secure defaults: secrets management, least-privilege IAM, network segmentation, and audit logging.
Own secrets management and access governance, applying least privilege and separation of duties across production systems.
Harden the GCP footprint (SecOps, Cloud Run, IAM, VPC, BigQuery, Secret Manager) and Cloudflare edge configuration (WAF, DNS, rate limiting, bot management).
Partner with product engineering on secure design reviews for new features before they ship.
Lead incident response: detection, containment, forensics, remediation, and blameless post-mortems - and build the tooling and runbooks so we respond faster next time.
Build detection and alerting for anomalous traffic, abuse, credential misuse, and scanning against our public endpoints (Cloud Run / load balancer / Cloudflare).
Develop log-based detection and investigation capability over Cloud Audit Logs, request logs, and application telemetry.
Run tabletop exercises and game days so our response is proven, not assumed.
Run threat modeling and secure code review across our Node.js / TypeScript services and APIs.
Own vulnerability management: scanning, dependency and supply-chain risk, triage, and remediation SLAs.
Coordinate penetration tests and external assessments, and drive findings to closure.
Protect sensitive customer, payroll, and identity data - classification, encryption, retention, and access controls.
Drive compliance and audit-readiness efforts (e.g., SOC 2, ISO 27001) and represent security to partners, auditors, and customers.
Own security policy, vendor and third-party risk review, and access review cycles.
Run security awareness and secure-development enablement for the engineering team.
Own data privacy risk - data residency, subject-access and deletion requests, and GDPR / CCPA obligations across the platform.
Own the infrastructure operations behind code releases: run and improve the deployment pipelines that ship our fleet of Cloud Run services to production, and be accountable for safe, repeatable releases (rollouts, rollbacks, and release hygiene).
Provide day-to-day operational support for our production infrastructure - keeping services healthy and available, responding to operational issues, and doing the maintenance, upgrades, and toil-reduction that keep the platform running.
Build and maintain CI/CD and infrastructure-as-code on GCP, with security controls built into the pipeline rather than bolted on.
Improve observability - logging, metrics, tracing, and alerting - so we find problems before customers do.
Be accountable for reliability - capacity, backups, and on-call - for systems that move money, on a mostly serverless architecture designed to keep operational load and toil low.
Operate and continuously improve our disaster recovery capability. Own our RTO/RPO targets, manage database backup and point-in-time recovery for our managed MySQL databases, maintain and refine failover procedures and DR runbooks, and run regular restore drills and game days so recovery stays proven, not assumed.
Keep the infrastructure upgraded over time.