Staff Security Engineer

Why Snaplii?
Snaplii is a profitable wallet and payments platform for people and their AI agents:
400,000+ users ,
about $150M in annual payment volume, and
500+ brand partners
including Costco, Walmart, Amazon and Uber.
Muse has taken off, and Snaplii is already live on it, with
about 2,000 AI agents
running on Snaplii. AI helps people decide what to buy. Snaplii completes the payment, safely.
The Opportunity
We’re hiring a Staff-level individual contributor with strong software engineering skills, deep AWS and Kubernetes security experience, and practical incident response experience. You will write and ship production code, lead security improvements across our applications and cloud environments, and coordinate the technical response to security incidents.
You will trace risks across code, identities, infrastructure and data, turn findings into engineering changes, and verify that those changes work in production. Recent development experience is essential: you should be comfortable working directly in our Java and Spring Boot services, writing automated tests, and taking changes through review, rollout and recovery.
At Staff level, your impact extends across teams. You will help engineering and business leaders prioritize risk, establish clear ownership, and build controls that other engineers can maintain.
What You’ll Own
Production security engineering — design, implement and review security-sensitive backend changes. Strengthen authentication, authorization, API boundaries, data access and business logic, with regression tests, observable behavior and safe rollout and rollback plans.
AWS and Kubernetes security — map assets, identities and trust relationships across AWS accounts and EKS clusters. Improve IAM and Kubernetes RBAC, workload identities, network boundaries, secrets handling and privileged access.
Incident response and trusted recovery — lead technical investigation and coordinate containment, evidence preservation, credential revocation and rotation, persistence checks, remediation and recovery. Distinguish confirmed facts from hypotheses, document gaps and define recovery acceptance criteria.
Detection and investigation — improve the coverage and usefulness of CloudTrail, EKS audit, S3, database and host logs. Build and tune detections for credential misuse, unusual data access, privilege escalation and suspicious execution, with clear escalation paths.
Credentials and software delivery — reduce long‑lifes and shared credentials;
strengthen GitHub, CI/CD, artifact and GitOps access. Build security checks into infrastructure as code, code review, dependency management and secret scanning, and verify remediation beyond individual alerts.
Security automation — write maintainable tools and services for asset and identity inventory, permission analysis, evidence collection, credential lifecycle management and control validation. Apply normal engineering standards to security tooling: tests, reviews, documentation and controlled releases.
Product and payment security — partner with payments, risk and application teams on transaction authorization, sensitive operations, partner integrations and abuse prevention. Secure AI agent credentials, spending limits and transaction‑level permissions.
Risk ownership and verification — maintain a prioritized security roadmap with named engineering owners, dependencies and acceptance criteria. Validate fixes, track unresolved risks and help leadership make explicit decisions about exceptions.
How You’ll Work
You will work with engineering leadership, application owners and the teams responsible for platform operations. You will lead security design, incident investigation and security acceptance criteria while contributing code and infrastructure changes directly. Application and platform owners remain responsible for their services and share responsibility for implementing and operating improvements.
You will help define authorized containment actions, escalation procedures and an on‑call arrangement with agreed coverage and backup support. You will also coordinate specialist support when needed. Routine availability, capacity management and backup operations are shared with service owners;
your role includes validating the security and recovery controls around them.
What We’re Looking For
Software engineering, cloud security and incident response are all core requirements. We look for evidence of work you personally delivered and the judgment you used to make it safe and effective.
Strong, current software engineering — substantial backend or platform development experience, including recent production coding. You can independently modify Java and Spring Boot services, reason about APIs, MySQL, Redis and asynchronous jobs, write meaningful automated tests, and deliver changes through deployment and maintenance.
Hands‑on AWS and Kubernetes security — practical experience securing production AWS and EKS environments, including IAM policies and role trust, Kubernetes RBAC and service accounts, workload identity, network access, secrets and infrastructure as code. You can reason about how weaknesses combine across systems.
Production incident response — experience owning substantial parts of a real security incident through investigation, containment, remediation and recovery verification. You can explain what the evidence established, what remained uncertain, how you protected evidence and how you managed business impact.
Application security depth — experience finding and fixing authentication and authorization flaws, injection, server‑side request forgery, unsafe execution paths and sensitive‑data exposure. You can translate threat models and code findings into tested production changes.
Linux, networking and investigation — confidence working with host, container, cloud and application evidence. You understand log coverage and retention limits, credential and session behavior, and the difference between an attempted action, a successful action and an unverified outcome.
Engineering for safe change — experience with CI/CD, infrastructure as code, observability, rollback and restoration testing. You can write security automation in Python, Go or another suitable language;
deep expertise in both Python and Go is not required.
Staff‑level technical leadership — a record of influencing architecture and engineering practices across teams, reviewing designs and code, mentoring engineers, and explaining risks and tradeoffs clearly to business leaders.
Nice to Have
Payments, digital wallets, gift cards or e‑commerce, including transaction integrity, idempotency and account abuse prevention.
Jenkins, Argo CD, Flux or similar delivery systems;
security controls for programmable business rules, scheduled execution and data stores.
Experience supporting PCI DSS or SOC 2 remediation, or working with external incident response and forensic specialists.
Windows or directory‑service security, security research or open‑source contributions, and responsible use of AI tools in engineering and investigation.
Your First 90 Days
First 30 days — build a shared map of critical services, AWS accounts, identities, sensitive data flows and logging coverage. Review existing controls and open findings, agree on priorities and owners, and identify the most urgent engineering changes.
By 60 days — ship and verify an agreed set of high‑priority application and infrastructure improvements. Establish repeatable checks for critical permissions, credentials and exposure, and improve the evidence needed to detect and investigate incidents.
By 90 days — complete a scoped incident response and recovery exercise with service owners. Validate containment and restoration procedures, document remaining gaps and establish a sustainable remediation and verification cadence.
Specific targets and dependencies will be agreed with engineering leadership after your initial assessment. Success means demonstrated risk reduction, reliable engineering changes and clear ownership, with evidence that controls and recovery procedures work.
How We Hire
Our process includes a discussion of work you personally delivered, a scoped coding exercise and a security incident scenario. In the coding exercise, we assess implementation, tests, security boundaries and a practical release and rollback plan. In the incident scenario, we assess evidence handling, technical reasoning, containment decisions, business impact and recovery criteria.
Sanitized or reconstructed examples are welcome. We never ask for confidential information, production access or credentials from current or previous employers.
We use AI tools to help screen and assess applications;
hiring decisions are made by people. This posting is for an existing vacancy. Visa sponsorship is available for the right candidate. If you need accommodation at any stage of the hiring process, let us know and we will work with you.
#J-18808-Ljbffr