Security Engineer

As a Security Engineer at Bastion, you join a regulated fintech company building infrastructure for stablecoins as the second engineer on the security team. You work alongside our Staff Security Engineer and report to our CTO/CISO, scaling a security program that already includes SOC 2 Type II, conditional OCC approval, a SIEM and detection pipeline, runtime security for Kubernetes, and auditable production access. Your work directly protects users and partners at a 40-person company operating under its own regulated entities.

What you'll do

• Get hands-on with our Go codebase, AWS and Kubernetes environment, SIEM, and security services; contribute security feedback to engineering design docs and ship your first security fix, guardrail, or detection to production in your first month
• Own at least one security domain end to end such as Kubernetes and cloud hardening, application security in CI, or detection engineering by 90 days
• Write and tune detections as code, add new telemetry sources, and reduce alert noise
• Ship reusable security libraries and middleware in Go (such as authorization, tenant isolation, request signing, or input validation) and get them adopted by service teams
• Be the security reviewer on design docs for new product features and architecture changes
• Deliver control automation and evidence for active audit and regulatory workstreams including SOC 1, SOC 2, and OCC compliance
• Help launch and triage our bug bounty program, and grow data loss prevention coverage and policies
• Join the security on-call rotation and contribute to incident response procedures
• Drive multi-quarter initiatives such as default-deny service-to-service networking, security policy evaluation, and just-in-time granular access across systems
• Expand Kubernetes cluster and container security including image scanning and signing, admission policies, pod security standards, and runtime protection
• Help expand compliance scope with automation instead of spreadsheets
• Turn tabletop exercises and resilience testing into concrete fixes
• Join cross-functional planning and influence the security roadmap

What you bring

• Ability to write production code, particularly in Go
• Experience with AWS, Kubernetes (EKS), and Terraform
• Hands-on experience with SIEM, detection engineering, and runtime security
• Knowledge of regulated environments and compliance frameworks such as SOC 1, SOC 2, and OCC requirements
• Comfort with startup pace where specific work changes and you must be productive by your third month

Nice to have

• Familiarity with MiCA and DORA regulatory requirements
• Experience in stablecoin or crypto infrastructure security
• Background in cloud security, Kubernetes hardening, or container supply chain security

What we offer

• Remote work within the US, with preference for candidates based in NYC or open to relocating

About Bastion

Bastion provides regulated infrastructure for businesses to hold, move, and issue stablecoins through custodial wallets, global payment orchestration, and stablecoin issuance capabilities. The platform is built almost entirely in Go, runs on Kubernetes (EKS) in AWS, and is managed with Terraform. Bastion operates through its own regulated entities with compliance and risk controls built into the platform.