{"id":3184109,"url":"https://alion.io/job/loancrate-senior-security-engineer","title":"Senior Security Engineer","company":{"id":679357,"name":"Loancrate","domain":"loancrate.com","url":"https://alion.io/company/loancrate","size_band":"1-10","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":170000,"max":300000,"currency":"USD","period":"year","gross":null,"usd_annual":300000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"GraphQL","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Pulumi","optional":false},{"name":"React.js","optional":false},{"name":"SBOM","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Amazon Aurora","optional":true},{"name":"Amazon CloudWatch","optional":true},{"name":"Amazon EC2","optional":true},{"name":"Amazon ECS","optional":true},{"name":"Apache Kafka","optional":true},{"name":"AWS Fargate","optional":true},{"name":"Buildkite","optional":true},{"name":"Cloudflare","optional":true},{"name":"Datadog","optional":true},{"name":"DNS","optional":true},{"name":"Docker","optional":true},{"name":"JavaScript","optional":true},{"name":"OpenSearch","optional":true},{"name":"OWASP Top 10","optional":true},{"name":"Pipeline as Code","optional":true},{"name":"PostgreSQL","optional":true},{"name":"Python","optional":true},{"name":"Redis","optional":true},{"name":"Sentry","optional":true}],"status":"live","first_seen_at":"2026-10-23T19:26:24Z","employer_posted_date":"2026-10-23","last_verified_at":"2026-10-27T12:18:39Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"What is Loancrate?\nWe started Loancrate to make home-buying simpler and less expensive for lenders and borrowers (us!). Today, mortgage lenders are stuck running their companies on software products built 20 years ago. These products are slow, unstable, and don't lead to material improvements in efficiency. When using these systems, the average human cost to originate a loan is still over $11,000.\nLoancrate builds AI-native tooling to automate mortgage workflows. Our ultimate goal is fully automated origination, which has the potential to save lenders over $16B in operating expense per year.\nSince starting in 2020, our remote team has enabled our customers to power >$85 billion in new home loans. We are a group of people excited to tackle the complexity of the home-lending industry. We care about collaboration, very open communication covering the good & the bad so that we learn from our decisions quickly, and ultimately having fun while we’re building. You’ll fit in well if you like diving deep quickly!\nThe Opportunity\nOur dreams are big and we have much to build! We’re looking for a Senior Security Engineer who makes Loancrate more secure - without making it harder to build here. You’ll build systems, guardrails, and tooling that catch issues early, make secure defaults easy, and help engineers move fast and sleep at night. We handle some of the most sensitive personal and financial data in the country, and we take that responsibility seriously - security is an enabler here, not a gatekeeper.\nThis is an IC role with broad scope - you’ll work across application security, infrastructure security, compliance, and internal tooling. If you’ve been in fintech or another regulated industry and gotten frustrated watching security slow engineering down, this is your chance to do it differently. You’ll write code, ship tooling, and improve our defaults - not just write policies.\nWhat To Expect\nAs a Senior Security Engineer at Loancrate, you’ll get into the codebase and infrastructure quickly. Within your first month, you’ll be contributing to work such as...\nConducting a comprehensive threat model of our application and infrastructure layers, identifying the highest-leverage gaps and building a pragmatic remediation roadmap.\n\nHardening our AWS infrastructure - IAM least-privilege, secrets management, network segmentation, CloudTrail audit coverage, and GuardDuty alerting - while keeping developer workflows frictionless.\n\nIntegrating security tooling into our CI/CD pipeline: SAST, dependency scanning, container image scanning, and secret detection that catches issues before they ship.\n\nPartnering with engineering on our SOC 2 Type II posture - working across evidence collection, control design, and vendor risk so that compliance is a byproduct of doing good security, not a separate workstream.\n\nBuilding secure-by-default patterns and libraries (authn/authz helpers, input validation, secure logging/redaction) so teams don’t have to reinvent security per service.\n\nCore Responsibilities\nLead and drive Loancrate’s security posture across application security, cloud security, identity, and compliance - partnering closely with engineering and leadership.\n\nPerform regular threat modeling, vulnerability assessments, and penetration testing - and work directly with engineering to remediate findings fast.\n\nBuild and maintain security tooling and automation: SAST/DAST, dependency scanning, container scanning, SBOM management, and secret detection integrated into CI/CD.\n\nHarden our AWS environment: IAM, VPC boundaries, secrets management (AWS Secrets Manager), audit logging, GuardDuty, Security Hub, KMS key management, and DDoS protection.\n\nOwn our SOC 2 Type II program - design practical controls, automate evidence collection where possible, manage the auditor relationship, and drive continuous improvement.\n\nLead or coordinate incident response for security events - runbooks, postmortems, and clear communication to customers and leadership when needed.\n\nEstablish and maintain a secure SDLC - lightweight design reviews, threat modeling in planning, and developer enablement (training, docs, examples) that scales.\n\nMaintain a risk register - tracking identified threats, ownership, and remediation status so nothing falls through the cracks.\n\nPartner with Operations on endpoint and device security: laptop hardening, MDM policy, hardware key rollout, and offboarding access revocation.\n\nManage third-party and vendor security risk, including due diligence for new integrations and annual reviews of existing vendors.\n\nOwn identity and access infrastructure: SSO, MFA enforcement (including hardware key policies), SCIM provisioning, and access reviews.\n\nContribute to security documentation, internal runbooks, and team education - you make the secure path the easy path.\n\nTech Stack\nOur infrastructure runs on AWS and is managed 100% with Terraform and Pulumi Cloud. Application services run in Docker on ECS EC2 or Fargate. Key services include Aurora PostgreSQL, ElastiCache (Redis), MSK (Kafka), and OpenSearch. Our CI/CD runs on Buildkite with TypeScript pipeline-as-code. Observability is powered by Datadog, CloudWatch, and Sentry. DNS and CDN are handled by Cloudflare. Application code is a TypeScript monorepo running Node/Express with a React frontend and GraphQL/Apollo API layer. We use GitHub for source control.\nPreferred Skills and Background\n(It’s okay not to have all of these things - these are just some skills we are excited about!)\nDeep application security experience: threat modeling, OWASP Top 10 (and beyond), secure code review, SAST/DAST tooling, and working directly with engineers to fix what you find.\n\nStrong AWS security experience across IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.\n\nTerraform and/or Pulumi proficiency - you can read and contribute to infrastructure-as-code, and you understand the security implications of what you’re reviewing.\n\nHands-on SOC 2 experience: you’ve designed controls, collected evidence, and managed an auditor relationship - not just checked boxes.\n\nCI/CD security experience: integrating security tooling into developer pipelines in a way engineers actually appreciate.\n\nFintech or regulated industry experience - you understand the intersection of security, compliance, and data privacy in a lending or financial services context.\n\nCollaborative mindset - you build relationships with engineering rather than operating as an external reviewer or blocker. You measure success by how secure the product is, not how many policies you’ve issued.\n\nIdentity and access experience: SSO/SAML, SCIM, MFA enforcement, hardware security keys, and access review programs.\n\nFamiliarity with data security for sensitive personal and financial data - encryption at rest and in transit, data classification, and minimization.\n\nStrong written communication - you document decisions, write clear runbooks, and communicate security risks to non-security audiences without FUD.\n\nScripting and automation chops (Python, Bash, or similar) - you build tools to make security scalable, not just write policies.\n\nPerks & Benefits\nRobust medical coverage (100% of employee + family premiums covered)\n\nVision & dental coverage\n\n401(k)\n\nHSA / FSA\n\nRemote-first culture - work from wherever you do your best work\n\nFlexible time off - we trust you to manage your time\n\nLoancrate is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. We do not discriminate on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other legally protected characteristic.","description_format":"text","description_chars":7740,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Flexible time off"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Mortgage Lending & Brokers"],"lifecycle":[{"event":"open","at":"2026-10-23T22:44:02Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"Filed H-1B visas in the last two years","filings_12m":0,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":null,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":3,"expected_fill_days":29,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-27T05:46:45Z"},"pay":{"stated_usd_annual":300000,"is_top_pay":true},"html_url":"https://alion.io/job/loancrate-senior-security-engineer","json_url":"https://alion.io/job/loancrate-senior-security-engineer.json","meta":{"generated_at":"2026-10-27T13:15:01Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1270,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":679357},"rest":"https://alion.io/mcp/rest/get_company?id=679357"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Floancrate-senior-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Floancrate-senior-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Floancrate-senior-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/loancrate-senior-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Floancrate-senior-security-engineer"}]}