Security Engineer - AppSec

About the Company

Rain is the global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. Our technology allows partners to move, store, and use stablecoins instantly and compliantly through global payment cards, rewards, on/offramps, wallets, and cross-border rails. As both a Visa and Mastercard Principal Member, Rain issues cards that work at more than 175 million merchant locations in over 220 countries and territories.

You will have the opportunity to deliver massive impact at a hypergrowth company backed by some of the top investors in fintech, crypto, and SaaS. In January 2026, we closed a $250M Series C led by ICONIQ, valuing Rain at $1.95B, with Sapphire Ventures, Dragonfly, Bessemer Venture Partners, Galaxy Ventures, FirstMark, Lightspeed, Norwest, and Endeavor Catalyst also participating. If you're curious, bold, and excited to help shape a borderless financial future, we'd love to talk.

About the Team

Security Engineering is a small team that answers one question: was it built right? We run our own AI-driven red team against Rain's code and cloud, gate pull requests before they merge, and write the baselines that say how every system should be configured. Our blockchain work is covered. This role owns everything else: the backend services, APIs, cloud, and edge that move real money for real customers.

We work closely with Security Operations: we give them high-quality findings to coordinate fixes for, and clear configuration rules they can build detections on.

About the Team

Security Engineering makes sure Rain is built right. We run our own AI-driven red team against our code and cloud, gate pull requests before they merge, and set the baselines for how every system is configured. This role owns everything outside blockchain: the backend services, APIs, cloud, and edge that move real money. We give Security Operations high-quality findings to coordinate fixes for, and clear configuration rules to build detections on.

About the Role

You'll be Rain's application security expert and the quality bar for every non-chain finding we produce. The calls are yours: what's real, how bad it is, and what has to be fixed before launch. You'll hold the line with engineers when it matters, and make the case so they agree, not just comply.

What You'll Do

• Review red team findings before they reach engineers: reproduce them, cut false positives, set severity, and write tickets clear enough to fix without a meeting. Improve the scoring that grades them
• Harden our backend services and APIs, especially the money-moving paths. You'll often write the fix yourself
• Own edge defenses: DDoS protection, rate limiting, WAF rules, and abuse controls
• Write secure configuration baselines for our cloud, code, and SaaS, and turn them into automated checks
• Grow our PR security gate so more bugs are blocked before merge
• Own attack surface coverage, and run architecture reviews on new and high-risk systems
• Find, test, and pick the best security tools, whether we buy, adopt, or build

What We're Looking For

• 4+ years in application security, product security, or security-minded backend engineering
• You've owned security decisions. You can tell a senior engineer their design needs to change and keep a good working relationship
• You can read an unfamiliar codebase (TypeScript/Node.js) and find the bug that matters, and you know a scary-sounding finding from a real one
• Hands-on cloud security (ideally GCP), Terraform, and edge defenses like WAFs and rate limiting
• Experience with threat models or architecture reviews. You've run tool bake-offs and dropped tools that didn't earn their cost
• You'd rather ship a check than write a document, and you use AI tools heavily without trusting them blindly

Bonus Attributes

• Fintech, payments, or card issuing background (PCI DSS a plus)
• Pentest, bug bounty, or red team experience
• Experience building security scanners, static analysis rules, or LLM-based review tools
• If you have the background: AI security for our agents and agentic payments, or corporate security alongside IT

In-office meals 🍜 Rainmakers working from the office enjoy lunch and dinner on us, covered with a DoorDash credit.