Senior Security Engineer

Loancrate•Los Angeles, CA

3d•$170,000 - $300,000•Remote

About The Position

Loancrate is hiring a Senior Security Engineer for an individual-contributor role with broad responsibility across application security, infrastructure security, compliance, and internal tooling. The engineer will strengthen security without creating unnecessary friction for product development by building systems, guardrails, automation, and secure-by-default tools. The role involves working directly in the codebase and infrastructure, partnering closely with engineering, operations, and leadership, and helping protect sensitive personal and financial data. Loancrate is a remote-first company building AI-native tooling to automate mortgage workflows.

Requirements

Strong application security experience, including threat modeling, OWASP Top 10 and beyond, secure code review, SAST/DAST tooling, and collaboration with engineers to remediate findings.
Strong AWS security experience across IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.
Proficiency with Terraform and/or Pulumi, including the ability to review and contribute to infrastructure-as-code and understand its security implications.
Hands-on SOC 2 experience designing controls, collecting evidence, and managing an auditor relationship.
Experience integrating security tooling into CI/CD pipelines in a way that works well for developers.
Identity and access experience with SSO/SAML, SCIM, MFA enforcement, hardware security keys, and access review programs.
Familiarity with data security for sensitive personal and financial data, including encryption at rest and in transit, data classification, and minimization.
Strong written communication skills, including documenting decisions, writing clear runbooks, and communicating risks to non-security audiences.
Scripting and automation skills in Python, Bash, or similar.

Nice To Haves

Fintech or regulated-industry experience, particularly in lending or financial services.
Collaborative approach that builds relationships with engineering and treats security as an enabler rather than a blocker.

Responsibilities

Lead Loancrate’s security posture across application security, cloud security, identity, and compliance in partnership with engineering and leadership.
Conduct threat modeling, vulnerability assessments, and penetration testing, and work with engineering to remediate findings.
Build and maintain security tooling and automation, including SAST/DAST, dependency and container scanning, SBOM management, and secret detection integrated into CI/CD.
Harden AWS infrastructure, including IAM, VPC boundaries, secrets management, audit logging, GuardDuty, Security Hub, KMS key management, and DDoS protection.
Own the SOC 2 Type II program by designing practical controls, automating evidence collection where possible, managing the auditor relationship, and driving continuous improvement.
Lead or coordinate security incident response, including runbooks, postmortems, and communication with customers and leadership when needed.
Establish and maintain a secure SDLC through design reviews, threat modeling in planning, developer training, documentation, and examples.
Maintain a risk register that tracks identified threats, ownership, and remediation status.
Partner with Operations on endpoint and device security, including laptop hardening, MDM policy, hardware key rollout, and offboarding access revocation.
Manage third-party and vendor security risk, including due diligence for new integrations and annual reviews of existing vendors.
Own identity and access infrastructure, including SSO, MFA enforcement, SCIM provisioning, and access reviews.
Contribute to security documentation, internal runbooks, and team education.
Build secure-by-default patterns and libraries, such as authentication and authorization helpers, input validation, and secure logging and redaction.