Security Engineer

The role

The Security Engineer will own the defensive and offensive security posture of Coinflow. This person will build the SecOps backbone, perform internal penetration testing, and partner with engineering to secure the SDLC.

What you will do

• Stand up and operate the SIEM.
• Build the SecOps dashboard for engineering, compliance, and leadership.
• Run continuous internal pentests against services, APIs, infrastructure, and embedded SDKs.
• Document findings, drive remediation, and measure mean-time-to-fix.
• Own the vulnerability lifecycle end-to-end.
• Triage CVEs across npm, cargo, and other ecosystems.
• Build automation for package patching.
• Monitor and improve the secure development lifecycle.
• Define secure-by-default patterns for new services.
• Work with the compliance function to produce evidence for PCI DSS, SOC 2, ISO 27001, and DORA.

Required qualifications

• 4+ years in a security engineering, product security, or DevSecOps role
• Strong hands-on offensive skills in web app, API, cloud, and infrastructure pentesting
• Production experience operating a SIEM (Datadog, Splunk, Elastic, Panther, or similar)
• Fluency in TypeScript/Node
• Passing comfort with Rust, Go, or Python
• Experience with vulnerability management at scale
• Comfort working with AI-native tooling (Claude Code, Claude Security, or similar)

Nice to have

• Experience at a fintech, payments company, or other regulated environment

Benefits

• Health and wellness benefits
• 401(k) savings plan
• Flexible time off
• Equity grant

About the company

Coinflow is a payment service provider serving marketplaces, fintechs, remittance providers, gaming platforms, and ecommerce merchants worldwide. The company is headquartered in Chicago, IL.