3 days ago
Responsibilities
- Threat model new systems and review designs with engineering teams before release.
- Build secure defaults, CI guardrails, dependency checks, and software supply-chain controls.
- Own vulnerability triage and remediation across Pensar, Semgrep, CodeQL, Dependabot, penetration tests, and researcher reports.
- Establish a vulnerability disclosure program and track remediation against SLAs.
- Harden GCP and GKE using least-privilege IAM, workload identity, secrets management, network policy, environment separation, and Terraform.
- Secure LLM, agent, and MCP surfaces with guardrails, sandboxes, scoped agent identities, and prompt-injection detection.
- Own SIEM detections, tune signal-to-noise, maintain runbooks, and participate in the on-call rotation.
- Lead security incidents through triage, containment, investigation, remediation, and post-mortem; run tabletop exercises and threat hunts.
Requirements
- 6+ years of security engineering experience or software engineering experience with a security focus.
- Hands-on production coding and tooling experience, rather than findings-only security work.
- Depth in product security, cloud and platform security, or detection and response, plus working knowledge of the other two areas.
- Experience with Python or Go, Kubernetes, Terraform, and at least one major cloud.
- Ability to change production systems, own outcomes, balance security risks against delivery velocity, and communicate clearly through design reviews, runbooks, and incident reports.
- Preferred: fintech, payments, or regulated-industry experience, including PCI DSS or SOC 2 evidence work.
- Preferred: bug bounty, red-team, CVE, conference-talk, or open-source experience.
- Preferred: hands-on AI security experience with guardrails, agent identities, or prompt-injection defenses.
Categories
About Rho
Rho builds an all-in-one business banking and spend management platform for startups and growing companies. The product combines corporate cards, cash management, bill pay, expense controls, and accounting integrations, delivered as a fintech platform with banking and payments services. Founded in 2018 and headquartered in New York, the privately held company targets U.S. businesses and provides human support to help teams open accounts and issue cards quickly.