19 days ago
Remote, United StatesSenior
Base Salary
$170k - $300k/yr
Responsibilities
- Lead Loancrate’s security posture across application security, cloud security, identity, compliance, and internal tooling.
- Conduct threat modeling, vulnerability assessments, and penetration testing, and partner with engineering on remediation.
- Build and maintain SAST/DAST, dependency scanning, container scanning, SBOM management, and secret-detection automation in CI/CD.
- Harden AWS infrastructure using IAM, VPC boundaries, Secrets Manager, CloudTrail, GuardDuty, Security Hub, KMS, and DDoS protection.
- Own the SOC 2 Type II program, including control design, evidence automation, auditor management, and continuous improvement.
- Lead or coordinate security incident response, including runbooks, postmortems, and stakeholder communication.
- Establish a secure SDLC through design reviews, planning-time threat modeling, documentation, training, and developer enablement.
- Maintain a risk register and manage remediation ownership and status.
- Partner with Operations on endpoint security, MDM, laptop hardening, hardware keys, and offboarding access revocation.
- Manage third-party and vendor security risk, including integration due diligence and annual reviews.
- Own identity and access infrastructure, including SSO, MFA, SCIM provisioning, and access reviews.
- Build secure-by-default libraries and patterns for authentication, authorization, input validation, and secure logging.
Requirements
- Deep application security experience with threat modeling, OWASP Top 10, secure code review, SAST/DAST tooling, and remediation collaboration.
- Strong AWS security experience with IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.
- Proficiency with Terraform and/or Pulumi and understanding of infrastructure-as-code security implications.
- Hands-on SOC 2 experience designing controls, collecting evidence, and managing auditor relationships.
- Experience integrating security tooling into CI/CD pipelines.
- Fintech or regulated-industry experience, particularly involving lending, financial services, security, compliance, or data privacy.
- Identity and access experience with SSO/SAML, SCIM, MFA enforcement, hardware security keys, and access review programs.
- Familiarity with protecting sensitive personal and financial data through encryption, classification, and minimization.
- Strong written communication skills for documenting decisions, writing runbooks, and explaining risks to non-security audiences.
- Scripting and automation experience with Python, Bash, or similar tools.
- Ability to collaborate closely with engineering and enable secure delivery without acting as an external blocker.
Benefits
- Medical coverage with 100% of employee and family premiums covered.
- Vision and dental coverage.
- 401(k) plan.
- HSA/FSA options.
- Remote-first work arrangement with flexibility to work from wherever the employee does their best work.
- Flexible time off.
Tech Stack
Apache KafkaAWSBashBuildkiteCloudflareDatadogDockerExpressGraphQLNode.jsPostgreSQLPythonReactRedisTerraformTypeScript
Categories
About Loancrate
Loancrate builds an AI‑native loan origination system for mortgage lenders, with features like AI‑powered document management, automated task lists, and configurable business rules. It sells the platform as enterprise SaaS to streamline underwriting and closing workflows and reduce manual processing. The company is privately held and targets the mortgage lending market, aiming to replace legacy LOS software with automation and hands‑on implementation support for lender teams.