Principal Security Engineer

DriveWealth•Austin, TX

2d•$215,000 - $235,000•Hybrid

About The Position

DriveWealth is seeking a highly motivated, experienced Principal Security Engineer to design, build, and mature security capabilities across its brokerage platform and corporate environment. Reporting to the Head of Security Engineering, this senior technical leader will own complex engineering initiatives and shape the architecture and implementation of controls that support business growth, protect client and consumer data, and meet or exceed regulatory obligations. The role is hands-on and covers security for AWS, Kubernetes services, low-latency trading infrastructure, and corporate technology. The engineer will combine architectural judgment with strong implementation skills to deliver scalable security solutions through software and automation, build and maintain platforms used by Security Operations, provide security consulting to business leaders and engineers, and partner with Engineering, IT, Risk, and Compliance. The position is available to candidates in New York City, Chicago, Austin, Dallas, Denver, Miami, the San Francisco Bay Area, or Seattle. New York- and Chicago-based employees are expected to attend the office on a cadence set by the Hiring Manager or team. Roles based in Austin, Dallas, Denver, Miami, the San Francisco Bay Area, or Seattle are fully remote, with occasional office visits potentially required. Remote work outside the listed locations is not accommodated. Applicants must be authorized to work in the United States without current or future visa sponsorship. The stated base pay range is $215,000–$235,000 USD.

Requirements

At least 10 years of relevant security, software, or infrastructure engineering experience, with a track record leading complex security initiatives from architecture through production operation.
Deep practical expertise in AWS and Kubernetes security, including IAM, workload identity, networking, container protection, and secure data access.
Strong working knowledge of endpoint, identity, and SaaS security across Windows and macOS.
Strong software and automation skills in Python or a comparable language, and practical experience with Terraform, CI/CD, GitOps, and security as code.
Experience building and operating security platforms, telemetry pipelines, detections, and response automation, with attention to data quality, reliability, and maintainability.
Sound architectural judgment, strong troubleshooting skills, and the ability to prioritize risk, manage competing initiatives, influence cross-functional decisions, and mentor technical colleagues.
Experience in regulated financial services or another environment with demanding availability and audit requirements.
Familiarity with NIST CSF or SP 800-53 is required.
Bachelor’s degree in a related field or equivalent practical experience.
Applicants must be authorized to work in the United States on a full-time basis without current or future visa sponsorship.
Candidates must be based in New York City, Chicago, Austin, Dallas, Denver, Miami, the San Francisco Bay Area, or Seattle.

Nice To Haves

Experience with Okta, JumpCloud, or comparable platforms.
Brokerage, SEC/FINRA, and privacy compliance experience.
Relevant security, AWS, Kubernetes, or GIAC certifications.

Responsibilities

Design and assist in implementing reusable security patterns and automated guardrails across product and corporate systems.
Own complex security initiatives from design and testing through deployment and ongoing maintenance, using vendor solutions, custom software, infrastructure as code, and measurable control improvements.
Mentor engineers, conduct design and code reviews, document architectures and runbooks, and influence technical decisions across Engineering and IT.
Engineer least privilege, workload identity, segmentation, encryption, and secure data access across AWS, EKS, EC2, DynamoDB, and colocated infrastructure while accounting for availability and trading latency.
Harden Windows and macOS, tune endpoint protection, and automate Okta and JumpCloud identity and device controls; strengthen privileged access, phishing-resistant authentication, and secure configurations for Slack and other SaaS applications.
Embed threat modeling, API security, security testing, image signing, policy enforcement, and runtime protections into development, CI/CD, and GitOps workflows.
Automate code, dependency, container, and infrastructure scanning; partner with Engineering and IT to prioritize remediation, verify fixes, and prevent recurring vulnerabilities.
Build, integrate, and maintain SIEM, SOAR, endpoint security, and vulnerability management services, including provisioning, monitoring, and documented maintenance and support procedures.
Engineer telemetry collection, normalization, and enrichment; partner with Security & Threat Operations to develop and validate analytics queries, detections, and automated response playbooks across cloud, application, identity, and endpoint systems.
Provide subject matter expertise for threat hunting and incidents, deliver containment automation, and lead post-incident hardening.
Translate requirements defined with Legal, Compliance, and GRC into tested technical controls, including SEC Rule 17a-3 and 17a-4 recordkeeping capabilities; automate evidence collection and support audits and regulatory examinations.
Build and maintain data discovery, classification, access control, encryption, retention, and secure deletion capabilities to support GDPR and other applicable privacy and data protection requirements.

Benefits

Competitive compensation, equity, and a 401(k) match.
Medical insurance.
Dental insurance.
Vision insurance.
Disability insurance.
Paid parental leave.
Wellness reimbursement.
Company-provided phone.
Personal development allowance.
Generous paid time off (PTO).
Observed holidays.
The role is eligible for base pay, bonus, equity, 401(k) match, and heavily subsidized benefits and perks.