Security Engineer - AppSec

The role

You will act as the application security expert to review red team findings and harden backend services, APIs, and edge defenses. You will also write secure configuration baselines and manage attack surface coverage.

What you will do

• Review red team findings, reproduce them, and set severity
• Harden backend services and APIs
• Own edge defenses including DDoS protection, rate limiting, WAF rules, and abuse controls
• Write secure configuration baselines for cloud, code, and SaaS
• Grow the PR security gate to block bugs before merge
• Own attack surface coverage and run architecture reviews
• Find, test, and pick security tools

Required qualifications

• 4+ years in application security, product security, or security-minded backend engineering
• Experience owning security decisions
• Ability to read TypeScript/Node.js codebases
• Hands-on cloud security (ideally GCP)
• Terraform
• Edge defenses like WAFs and rate limiting
• Experience with threat models or architecture reviews
• Experience running tool bake-offs
• Heavy use of AI tools

Nice to have

• Fintech, payments, or card issuing background
• PCI DSS a plus
• Pentest, bug bounty, or red team experience
• Experience building security scanners, static analysis rules, or LLM-based review tools
• AI security for agents and agentic payments
• Corporate security alongside IT

Benefits

• Unlimited time off (minimum 10 days required)
• Flexible working
• Home workspace stipend for new employees
• US Rainmakers cover 95% of health, dental, and vision plan costs and 90% for dependents
• 100% company-subsidized life insurance plan
• 401(k) with a 4% company match
• Equity option plan
• Monthly stipend for health and wellness spending
• In-office meals via DoorDash credit
• Team and company offsites, both domestic and international

About the company

Rain is the global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. It is a hypergrowth company valued at $1.95B.