Senior Security Engineer

• WHAT IS LOANCRATE?
• Loancrate builds AI-native tooling to automate mortgage workflows. Our ultimate goal is fully automated origination, which has the potential to save lenders over $16B in operating expense per year.
• As a Senior Security Engineer at Loancrate, you’ll get into the codebase and infrastructure quickly. Within your first month, you’ll be contributing to work such as...
• Conducting a comprehensive threat model of our application and infrastructure layers, identifying the highest-leverage gaps and building a pragmatic remediation roadmap.
• Hardening our AWS infrastructure - IAM least-privilege, secrets management, network segmentation, CloudTrail audit coverage, and GuardDuty alerting - while keeping developer workflows frictionless.
• Integrating security tooling into our CI/CD pipeline: SAST, dependency scanning, container image scanning, and secret detection that catches issues before they ship.
• Partnering with engineering on our SOC 2 Type II posture - working across evidence collection, control design, and vendor risk so that compliance is a byproduct of doing good security, not a separate workstream.
• Building secure-by-default patterns and libraries (authn/authz helpers, input validation, secure logging/redaction) so teams don’t have to reinvent security per service.
• Lead and drive Loancrate’s security posture across application security, cloud security, identity, and compliance - partnering closely with engineering and leadership.
• Perform regular threat modeling, vulnerability assessments, and penetration testing - and work directly with engineering to remediate findings fast.
• Build and maintain security tooling and automation: SAST/DAST, dependency scanning, container scanning, SBOM management, and secret detection integrated into CI/CD.
• Harden our AWS environment: IAM, VPC boundaries, secrets management (AWS Secrets Manager), audit logging, GuardDuty, Security Hub, KMS key management, and DDoS protection.
• Own our SOC 2 Type II program - design practical controls, automate evidence collection where possible, manage the auditor relationship, and drive continuous improvement.
• Lead or coordinate incident response for security events - runbooks, postmortems, and clear communication to customers and leadership when needed.
• Establish and maintain a secure SDLC - lightweight design reviews, threat modeling in planning, and developer enablement (training, docs, examples) that scales.
• Maintain a risk register - tracking identified threats, ownership, and remediation status so nothing falls through the cracks.
• Partner with Operations on endpoint and device security: laptop hardening, MDM policy, hardware key rollout, and offboarding access revocation.
• Manage third-party and vendor security risk, including due diligence for new integrations and annual reviews of existing vendors.
• Own identity and access infrastructure: SSO, MFA enforcement (including hardware key policies), SCIM provisioning, and access reviews.
• Contribute to security documentation, internal runbooks, and team education - you make the secure path the easy path.
• (It’s okay not to have all of these things - these are just some skills we are excited about!)
• Deep application security experience: threat modeling, OWASP Top 10 (and beyond), secure code review, SAST/DAST tooling, and working directly with engineers to fix what you find.
• Strong AWS security experience across IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.
• Terraform and/or Pulumi proficiency - you can read and contribute to infrastructure-as-code, and you understand the security implications of what you’re reviewing.

None flagged.