Staff Security Engineer

United States·New Yorkfull-timelead

EngineeringSecurity Engineer

0 views0 saves0 applied

Apply Now

Quick Summary

Key Responsibilities

secure defaults, guardrails in CI, dependency and supply chain checks, so the safe way is the easy way. Own the vulnerability lifecycle: triage findings from Pensar, Semgrep, CodeQL, Dependabot,

Technical Tools

EngineeringSecurity Engineer

Rho is the modern banking platform built for the AI era. Startups and growth-stage companies can open accounts in minutes, issue cards, manage expenses, pay bills, and close the books – all in one connected platform backed by real human support.

Rho is on a mission to make finance frictionless for organizations. Our team and technology power high-performing companies with an all-in-one, end-to-end finance platform that lets organizations safely manage cash and spending across commercial-grade banking, corporate cards, treasury management, expense management, accounts payable, and more.

Our customers run their banking, cards, and payments through Rho. We are splitting a large Python monolith into Go and Python services on GCP, and shipping a public API, agents, and MCP surfaces. Security is part of the product.

The Team

Security at Rho is small: a VCISO, one security engineer in Poland, and the engineers who ship. You will be the first US security engineer. We plan to grow this into a team over the next six months, and you will help pick who.

The Role

Hands-on. You write production code most days. You own product and platform security, and you own finding queues and incident response until we hire for detection and response.

Responsibilities

~1 min read

→
6+ years in security engineering, or software engineering with a security focus. You ship code and tools, not only findings.
→
Depth in one of product security, cloud and platform security, or detection and response, and working knowledge of the other two.
→
Comfortable changing production and owning the outcome. Python or Go, Kubernetes, Terraform, one major cloud.
→
You can triage competing risks and trade security against velocity without slowing the team down.
→
Clear writer: design reviews, runbooks and incident reports engineers actually read.

NICE TO HAVE

→
Fintech, payments or another regulated industry. PCI DSS or SOC 2 evidence work.
→
Bug bounty, red team, CVEs, talks, or open source.
→
Hands-on AI security: guardrails, agent identities, prompt injection.