Senior DevSecOps Engineer

Greenboard•New York, NY

2d•$165,000 - $230,000

About The Position

Greenboard is hiring a hands-on security engineer to own and scale the company’s security posture as it grows. This is the first dedicated security hire on the engineering team, with responsibility for shaping security practices across compliance frameworks, vendor diligence, infrastructure hardening, and secure development. The role works closely with engineering, product, and business teams to build securely, meet fintech customers’ compliance expectations, and address security needs as the company expands internationally. The position spans technical security, compliance, vendor and customer diligence, and IT and device security. The engineer will manage vulnerability remediation and penetration testing; integrate security into development workflows; oversee secrets, infrastructure hardening, and endpoint controls; own SOC 2 and support GDPR and ISO 42001 compliance; and maintain processes and documentation for vendor reviews and customer security diligence. This is described as a high-impact, high-autonomy build-it role.

Requirements

5–10 years of experience in security engineering, application security, or infrastructure security roles.
Hands-on experience with SOC 2 audits and at least one other compliance framework, such as GDPR, ISO 27001, PCI-DSS, or similar.
Strong technical foundation, including comfort reading code, reviewing AWS infrastructure, and working in a CI/CD environment.
Experience with vulnerability management tooling such as Snyk, Semgrep, Qualys, Burp Suite, or equivalents.
Familiarity with AWS Secrets Manager and IAM best practices.
Experience managing or coordinating third-party penetration tests.
Clear, low-ego communication skills, including the ability to explain risks to engineers and compliance requirements to salespeople.
Comfort with ambiguity and ownership in a build-it role.

Nice To Haves

Prior experience at a fintech or other regulated-industry startup.
Familiarity with ISO 42001 or AI governance frameworks.
Experience with MDM platforms.
Background supporting international expansion from a security or compliance perspective.

Responsibilities

Detect, triage, and drive remediation of vulnerabilities across infrastructure, applications, and networks.
Manage third-party penetration tests and coordinate internal responses to findings.
Integrate security into the development lifecycle through code review guardrails, SAST/DAST tooling, dependency scanning, and developer security guidance.
Own credential and secrets management, including rotation policies, vault configuration, and access controls.
Manage infrastructure patching and hardening in coordination with engineering.
Own the SOC 2 compliance program, including audit preparation, evidence collection, and remediation tracking.
Maintain and mature GDPR compliance in partnership with legal and product teams.
Lead ISO 42001 certification efforts by establishing and maintaining required AI management system controls.
Research and implement additional compliance frameworks as the company enters new markets.
Manage inbound customer security diligence requests, including questionnaires, evidence coordination, and calls as needed.
Build and maintain a vendor security review process for third-party tools and services.
Maintain current security documentation, including policies, SOC 2 reports, and architecture diagrams.
Manage endpoint security, including MDM, disk encryption, OS patching, and device compliance policies.
Maintain and enforce access control policies for corporate tools and systems, including SSO, MFA, and least-privilege access.