Software Engineer, Security

About the role

This is a hands-on engineering role focused on security: you’ll build and ship changes to our application and infrastructure, not just assess risk or coordinate fixes. We're looking for a Software Engineer to own and scale the security of our platform as we grow fast.

You'll be responsible for keeping our systems secure across the entire stack - from network and infrastructure to application-level security - while establishing the patterns and guardrails that let the rest of the team move quickly without having to worry about security.

You'll define and own our security program end-to-end, and play a key role in enabling Slash to serve billions of dollars in business spend reliably and securely.

What you'll do

• Own Slash's security program end-to-end - find gaps, prioritize, and propose and drive changes independently
• Work on network security: manage and harden our Cloudflare implementation, AWS WAF, VPC networking, and overall infrastructure posture
• Work on application security: ship features like passkey authentication, SMS rate limiting, and other product-level hardening
• Manage recurring pen tests and our bug bounty program, and coordinate remediation across engineering
• Assist on compliance efforts like PCI and SOC 2
• Establish security patterns, tooling, and guardrails that enable the rest of the team to move fast safely
• Own corporate IT security, including keeping company equipment and endpoints secure
• Interface with customers, internal stakeholders, and key vendors to answer questions and provide confidence in Slash's security practices

We're looking for someone who

• Is a software engineer first - has experience building and shipping production software in TypeScript or another programming language, and wants to apply those skills to security. Doesn’t just identify gaps or recommend fixes; writes the code and owns the implementation.
• Has broad security knowledge across application code and infrastructure, and is comfortable reading, debugging, and changing the systems they’re securing. Our stack includes Kubernetes/EKS, CockroachDB, Kafka, Terraform/Pulumi, and AWS.
• Can independently identify security gaps, prioritize them based on risk, and drive high-impact improvements through to production without waiting to be told what to work on.
• Is organized and able to coordinate pen tests and audits, manage competing security priorities, and ensure findings get resolved

What's in it for You

• Opportunity for high growth
• High autonomy + ownership culture
• Comprehensive health + benefits plan
• Working out of our downtown San Francisco office space
• Unlimited PTO