Software Engineer - Risk

Cardless is building the infrastructure for the world's best companies to design, build, and launch financial products of their own. Companies like Coinbase and Bilt use Cardless to create credit cards that feel entirely their own. In an industry where branded financial products usually mean shared logos and shared control, Cardless is built to disappear. Our APIs and components shape the journey from the first application to every purchase, reward, and moment of support that follows, while we handle lending, compliance, and operations behind the scenes.

In September 2025, we raised a $60 million Series C led by Spark Capital, bringing our total funding to $170 million. The team is over 70 people and scaling toward profitability by year-end 2026.

We're looking for kind, humble people with high standards and low egos. We take the work seriously without taking ourselves too seriously. We see what could be improved, make it so, and leave every product, system, and team better than we found it.

As a Risk Engineer at Cardless, you'll own the systems that decide whether to trust a person, a device, or a transaction.

We're bringing fraud decisioning in-house. Much of it runs through vendor platforms today, which serve us well but leaves the decisions, the tuning, and the visibility outside systems we control. You'll build that layer: risk rules as versioned code, controls with kill switches, and detection our analysts can watch in real time. This is a senior-to-staff role with real architectural ownership, working directly with our Risk and Fraud Operations teams.

• →

  Build the risk decisioning layer for card authorization and mobile wallet provisioning: what gets approved, stepped up, or frozen

• →

  Move fraud logic out of vendor dashboards into one testable control plane, with shadow mode, staged rollout, and kill switches

• →

  Build real-time detection and alerting across velocity, cross-provisioning, and device signals, plus a lockdown posture for active attacks

• →

  Gate servicing changes (address, phone, email, reship) on risk evaluation, and ship the tooling our fraud analysts work in daily

• 6+ years building production backend systems, with meaningful time in fraud, payments risk, or trust and safety engineering

• You've built risk systems as an engineer: decisioning services, rules engines, real-time scoring, step-up orchestration. Not analyzing fraud or handing models off for someone else to deploy

• Strong distributed systems and API fundamentals in a modern backend language (we're primarily Java, with Python for data work)

• You think in blast radius: what if this rule is wrong, how fast can we turn it off, how will we know? And you're steady in an incident

• Card issuing: auth-time decisioning, tokenization, wallet provisioning, disputes, and PCI knowledge would all be huge pluses

• Account takeover and step-up auth: OTP, SIM swap, phishing resistance, device fingerprinting, passkeys, IDV

• You've worked at a risk or identity vendor (Sardine, Sift, Unit21, Feedzai, Alloy, Persona) and want the issuer side

• You want to build models rather than the systems that run them

• You'd rather tune an established platform than design one

• You want clean separation from operations, or to work remotely

Fraud is one of the few problems in fintech where the adversary adapts to you personally, in days, and one of the few where good engineering is immediately impactful. You can watch a control go live and watch the losses stop as fast as you can ship.

We’re looking for the founding risk engineer who we can eventually build the team around at Cardless. You'll decide what the platform is, what belongs in code versus vendor config, and what "defended" means here across every brand we launch. The second-order effect is a better product: tighter controls, done well, mean fewer false positives and less friction for the customers who deserve none.

San Francisco, CA — our office is in the Jackson Square district. This role is 5 days a week in office.