Security Engineer

Coinflow•Chicago, IL

2d•Onsite

About The Position

Coinflow is seeking a Security Engineer to take ownership of the company's day-to-day defensive and offensive security posture. This role involves building the SecOps backbone, proactively identifying weaknesses in the company's stack, and collaborating with the engineering team to ensure a fast and secure Software Development Lifecycle (SDLC). The position reports directly to the CTO and has a significant influence across the entire engineering organization. The Security Engineer will work hands-on with modern AI-native security tools, such as Claude Security and Claude Code, to enhance internal penetration testing, code review, and remediation efforts. This is an opportunity for someone excited about being among the first security engineers to build using these advanced methods.

Requirements

4+ years in a security engineering, product security, or DevSecOps role, preferably in a fintech, payments, or regulated environment.
Strong hands-on offensive skills with experience in web application, API, cloud, and infrastructure penetration testing.
Production experience operating a SIEM (Datadog, Splunk, Elastic, Panther, or similar) and building dashboards for engineers.
Fluency in TypeScript/Node and comfort with Rust, Go, or Python for code reading and tooling development.
Experience with vulnerability management at scale, including CVE triage, SCA tooling, and dependency upgrade automation.
Comfort or excitement working with AI-native tooling (Claude Code, Claude Security, or similar) as a daily driver.
A bias toward shipping working solutions quickly.

Responsibilities

Stand up and operate the SIEM and build out the SecOps dashboard for real-time security posture monitoring.
Conduct continuous internal penetration tests against Coinflow services, APIs, infrastructure, and embedded SDKs, utilizing AI tools for automation.
Own the end-to-end vulnerability lifecycle, including triaging CVEs and building automation for package patching.
Monitor and improve the secure development lifecycle, defining secure-by-default patterns, reviewing threat models, and integrating security scanning into CI.
Partner with the compliance function to produce necessary evidence and controls for auditors.