Security Engineer - AppSec

As a Security Engineer at Rain, you are the application security expert who sets the quality bar for every non-blockchain security finding. You own the calls: what's real, how bad it is, and what has to be fixed before launch. You work on the backend services, APIs, cloud, and edge infrastructure that move real money for more than 100 organizations worldwide.

What you'll do

• Review red team findings before they reach engineers: reproduce them, cut false positives, set severity, and write tickets clear enough to fix without a meeting
• Harden backend services and APIs, especially the money-moving paths, often writing fixes yourself
• Own edge defenses: DDoS protection, rate limiting, WAF rules, and abuse controls
• Write secure configuration baselines for cloud, code, and SaaS systems, and turn them into automated checks
• Grow the PR security gate so more bugs are blocked before merge
• Own attack surface coverage and run architecture reviews on new and high-risk systems
• Find, test, and pick the best security tools, whether you buy, adopt, or build them

What you bring

• 4+ years in application security, product security, or security-minded backend engineering
• Experience owning security decisions and influencing senior engineers on design changes
• Ability to read unfamiliar codebases (TypeScript/Node.js), find bugs that matter, and distinguish real findings from noise
• Hands-on cloud security experience, ideally with GCP, Terraform, and edge defenses like WAFs and rate limiting
• Experience with threat models or architecture reviews, and a track record of evaluating and adopting or dropping security tools based on real value
• A preference for shipping working code over writing documents, and the ability to use AI tools heavily without blind trust

Nice to have

• Fintech, payments, or card issuing background (PCI DSS experience a plus)
• Pentest, bug bounty, or red team experience
• Experience building security scanners, static analysis rules, or LLM-based review tools
• AI security for agents and agentic payments, or corporate security alongside IT

What we offer

• Unlimited vacation (minimum 10 days per year)
• Flexible working: work from home, office, or both; home office setup stipend for new hires
• Health, dental, and vision coverage (95% covered for employees, 90% for dependents in the US); 100% company-subsidized life insurance
• 401(k) with 4% company match
• Equity option plan for all employees
• Monthly stipend for health and wellness (gym memberships, fitness classes, massages, acupuncture, etc.)
• In-office meals (lunch and dinner with DoorDash credit for those working from the office)
• Regular team and company offsites, domestic and international

About Rain

Rain is the global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. As both a Visa and Mastercard Principal Member, Rain issues cards that work at more than 175 million merchant locations in over 220 countries and territories. Backed by top-tier investors including ICONIQ, Sapphire Ventures, and Dragonfly, Rain closed a $250M Series C in January 2026 and is valued at $1.95B.