Note: The job is a remote job and is open to candidates in USA. Credit Sesame is hiring a Senior Security Engineer to own end-to-end security for its platform. The role covers security reviews, cloud and application security, incident response, compliance controls, security automation, and threat modeling of AI/LLM systems.

Responsibilities

• Run security reviews for new tools, vendors, and projects — data handling, AI usage, DPAs, PII, authentication/authorization, and third-party security reports (SOC 2, PCI, ISO, pentest results)
• Own access and infrastructure security — IAM least-privilege reviews, S3/database access controls, environment segregation, service-to-service authentication, and network configuration audits (VPC flow logs, inbound/outbound rules)
• Run vulnerability management across cloud and endpoints, and manage IDS/IPS (e.g., Palo Alto Panorama, AWS WAF) and EDR/MDR tooling
• Lead security incident response end to end — triage, investigate, contain, document, and build the runbooks as you go
• Implement and maintain the technical controls supporting our PCI DSS and SOC 2 / ISO 27001 compliance programs, including internal audits, risk metrics, and disaster recovery planning
• Partner with DevOps/IT on patch management and secure infrastructure defaults, and present tooling and risk recommendations to engineering leadership
• Build our in-house AppSec scanning program — evaluate and pilot SAST/SCA/IaC tooling (Semgrep, Trivy, Upwind), integrate into GitLab CI and Jenkins, define severity-based remediation SLAs, and drive rollout across services
• Build internal security tooling and automation — custom scripts and integrations (Python/boto3, APIs) that pull data from tools without native integrations into shared dashboards and reports
• Build and tune detection pipelines — for example, feeding traffic/bot-protection alerts (Datadome) into our log platform (ELK/Kibana) and writing rules that catch real attack patterns
• Threat-model and pentest our AI/LLM systems — scope risks like prompt injection and data exfiltration through MCP servers, coordinate external pentests where needed, and drive remediation
• Maintain security policies and practices and drive training and adoption throughout the company

Skills

• You have 7+ years of hands-on security engineering experience across application security, cloud security, and network/penetration testing — not just one lane
• You've driven tooling or architecture decisions independently (evaluated options, made the call, defended it to leadership)
• You're self-directed, pragmatic, and ruthless about prioritization
• You've built production automation from scratch — API integrations, custom collectors, or internal tooling — not just one-off scripts
• You have hands-on experience deploying and running OSS security tools — Burp Suite Community/OWASP ZAP, Nmap, Nuclei, Metasploit, Semgrep, Trivy, Wazuh/OSSEC, ELK/Kibana, Prowler/ScoutSuite, HashiCorp Vault, or similar
• You have solid AWS security experience
• You have working knowledge of PCI DSS, SOC 2, and ISO 27001 — enough to implement controls and support audits
• You're curious about emerging security domains and comfortable threat-modeling systems (like AI/LLM applications) that don't have an established playbook yet
• You're an excellent communicator who can translate cost/coverage tradeoffs and technical risk for both engineers and executives
• BS in Computer Science or related field, or equivalent hands-on experience
• OSCP, GPEN, or similar certifications
• Bug bounty experience
• Prior experience at a startup
• Experience securing LLM/AI-based systems

Benefits

• Equity in a pre-IPO company backed by top VCs
• Comprehensive medical, dental, and vision insurance
• Monthly home office stipend
• Professional development program to support your continued growth
• Flexible paid time off
• 10 paid holidays and 6 additional Sesame Wellness days
• A culture that emphasizes total wellness, including work-life harmony

Company Overview

Company H1B Sponsorship