5 hours ago
Base Salary
$268k - $321k/yr
Responsibilities
- Drive the application security roadmap covering secure SDLC, code review, threat modeling, vulnerability management, penetration testing, and bug bounty programs.
- Build and operate SAST, SCA, secrets-scanning, dependency-policy, and AI-assisted security tooling integrated into CI.
- Develop secure authentication, authorization, input-validation, session-management, MFA, account-recovery, API, and mobile security patterns.
- Protect LLM-backed features through prompt-injection defenses, tool-permission boundaries, and data-exposure controls.
- Run penetration testing and bug bounty programs, triage findings, drive remediation, and maintain defined remediation SLAs and audit evidence.
- Threat model products and features, support engineering design reviews, and establish a security champions and developer education program.
Requirements
- 6+ years of security engineering experience with deep, hands-on application security experience, including secure code review, threat modeling, vulnerability triage, and remediation at scale.
- Production programming experience and fluency in at least one of Ruby, Python, Go, or TypeScript, with the ability to read all four.
- Experience designing and shipping authentication and authorization systems involving OAuth/OIDC, session management, MFA, and account recovery.
- Hands-on experience with SAST, SCA, DAST, secrets scanning, and CI/CD integration.
- Experience securing REST/GraphQL APIs and native mobile applications.
- Experience running or building a penetration-testing or bug-bounty program.
- Experience working in a regulated environment such as PCI-DSS or SOC 2.
- Preferred experience securing LLM-backed or agentic workloads, fraud and abuse defenses, security champions programs, supply-chain security, or consumer fintech.
Tech Stack
Categories
About Kikoff
Kikoff builds consumer fintech products to help people establish and improve credit, including a reported Credit Account tradeline, rent and bill reporting, identity protection, and an AI-powered debt negotiation tool; its platform uses machine learning for underwriting, fraud, and personalization. The company monetizes through credit-building accounts and related financial services. Founded in 2019 and headquartered in San Francisco, it is privately held and serves U.S. consumers focused on credit building and financial wellness.