Lead Security and Infrastructure Engineer

About the Role

We are looking for a hands-on Lead Security and Infrastructure Engineer to own security, infrastructure operations, and reliability across our cloud, application, and platform environments, including the on-chain rails behind our stablecoin payments.

You'll work directly with the CTO as the founding security and infrastructure hire, and someone the CTO can hand the keys to. You'll be responsible for hardening existing systems, building missing security and infrastructure capabilities, supporting production operations, and establishing the processes and tooling needed as the company scales.

The technology environment includes Google Cloud Platform, Cloud Run, BigQuery, MySQL, Node.js, TypeScript, and Cloudflare, alongside Ethereum and EVM-compatible networks, wallets, stablecoins, and smart contracts. No prior blockchain experience is required, this is a nice to have, not a gate.

This is an ownership role, not a devops role with a security task list. You'll hold full, end to end responsibility for the company's security, sensitive access and critical systems included, with enough infrastructure and DevOps fluency to operate comfortably in a lean, cloud native environment. Security is the center of gravity for this role, roughly two thirds of your time, with infrastructure operations and reliability making up the other third.

What Success Looks Like in Your First 3-6 Months

• Establish clear security ownership, access controls, secrets management, and secure defaults across production systems.
• Improve incident detection, response procedures, runbooks, and post-incident processes.
• Strengthen our cloud, Cloudflare, database, and deployment configurations against security and reliability risks.
• Improve observability across production infrastructure so issues are detected before they impact customers.
• Validate backup, disaster recovery, RTO/RPO, and restoration procedures through hands-on drills.
• Establish a practical roadmap for the security and infrastructure function as the company scales.

Key Responsibilities

Security Engineering

• Own the security posture across cloud, application, and on-chain systems.
• Lead security incident response, including detection, containment, forensics, remediation, and blameless post-mortems.
• Build security tooling, runbooks, and processes that improve incident response over time.
• Establish secure defaults for secrets management, IAM, network segmentation, audit logging, and production access.
• Own access governance, least-privilege policies, and separation of duties across production systems.
• Conduct threat modeling, vulnerability management, and recurring security reviews.
• Build detection and alerting for anomalous traffic, abuse, and scanning across Cloud Run, load balancers, and Cloudflare, turning logs into signal and signal into alerts people act on.
• Own compliance and audit-readiness initiatives, including maintaining and maturing our existing SOC 2 program.
• Build and drive security awareness across the team, from onboarding to ongoing training.
• Represent security requirements with partners, customers, and internal stakeholders.

Infrastructure Operations & Reliability

• Own the infrastructure operations supporting production releases.
• Build and improve CI/CD pipelines for deploying Cloud Run services safely and consistently.
• Own release hygiene, including rollouts, rollbacks, deployment controls, and operational readiness.
• Provide hands-on operational support for production infrastructure.
• Perform maintenance, upgrades, troubleshooting, and toil reduction across the platform.
• Build and maintain infrastructure-as-code and deployment automation on GCP.
• Harden Cloud Run, BigQuery, MySQL, and Cloudflare configurations.
• Improve logging, metrics, tracing, monitoring, and alerting.
• Own reliability practices around capacity, backups, availability, and on-call operations.
• Own disaster recovery capabilities, including RTO/RPO targets, database backups, point-in-time recovery, failover procedures, and DR runbooks.
• Run regular restoration drills and game days to validate recovery procedures.

Digital Assets & On-Chain Exposure (Nice to Have)

• Curiosity about Ethereum and EVM integrations, including wallet and key management, transaction signing, and smart-contract interactions is a plus, not a requirement.
• Willingness to learn on-chain settlement flows and stablecoin operations as part of the role.

Requirements

• 8+ years fully owning a company's security posture end to end, with enough infrastructure and DevOps fluency to operate comfortably in a lean, cloud native environment.
• Demonstrated experience holding primary or sole responsibility for a company's security, including sensitive access and critical systems, someone the CTO can hand the keys to.
• Experience operating at a senior or lead level, with enough judgment to set security and infrastructure direction as a founding hire.
• Deep, hands-on cloud security experience, ideally Google Cloud Platform (IAM, networking, logging and monitoring, Security Command Center). Strong AWS or Azure depth with a willingness to go deep on GCP also works.
• Strong security fundamentals across IAM, least privilege, secrets and key management, network security, incident response, and vulnerability management.
• Detection engineering instincts, able to turn logs into signal and signal into actionable alerts.
• Strong experience with Cloudflare, including WAF, DNS, rate limiting, edge security, and Pages.
• Experience with Node.js / TypeScript application environments.
• Experience working with MySQL in production.
• Strong infrastructure-as-code and CI/CD experience.
• Demonstrated incident response experience in production environments.
• SOC 2 experience, ideally maintaining and maturing an existing certification rather than building one from scratch, comfortable with disaster recovery exercises, ongoing vulnerability management, and policy upkeep.
• Must be authorized to work in the United States and currently based in the United States.

Preferred Qualifications

• Experience in fintech, payments, payroll, or another regulated environment that handles funds or sensitive financial data.
• ISO 27001 or PCI DSS experience.
• Security certifications such as CISSP, OSCP, or GCP Professional Cloud Security Engineer.
• Curiosity about digital-asset payments, we settle in both fiat and stablecoins, so there's plenty to learn, but no prior blockchain experience is required.
• Experience building a security or infrastructure function from the ground up.
• Experience designing and operating disaster recovery programs for financial or high-availability systems.

Compensation & Logistics

• Base Salary: $170,000-$210,000 USD per year
• Equity: Meaningful equity participation
• Time Off: Unlimited PTO
• Schedule: Flexible work schedule focused on outcomes
• Benefits: 401(k) with a 3% company contribution
• Work Model: Fully remote
• Location: United States
• Employment: Full-time

Company Overview

Our client is a global payments and payroll platform built for modern, distributed teams. The platform enables businesses to pay employees, contractors, and freelancers across borders using both traditional banking rails and digital assets.

The platform manages the infrastructure behind cross-border payments, including invoicing, KYC/KYB, onboarding, compliance, tax, identity, and reporting.

The technology operates at the intersection of traditional finance and Ethereum-based settlement. The stack includes Google Cloud Platform, Cloud Run, BigQuery, MySQL, Node.js, TypeScript, and Cloudflare, alongside a large smart-contract ecosystem deployed across EVM-compatible networks.

The team is lean, remote-first, and high ownership. Security, correctness, accountability, direct communication, and strong documentation are especially important because the platform handles real money and sensitive customer information.