Senior Software Engineer, Security Platform
Sezzle
IndiaremotePosted 9 days ago
Skill Required
Software-EngineerSecurity-EngineerBackend-EngineerDevSecOps-EngineerPlatform-EngineerSenior-Cloud-Security-Software-EngineerSecurity-Platform-EngineerSecurity-Software-EngineerPlatform EngineerSecurity EngineerSoftware EngineerSoftware Developersecuritysoftware engineeringObservabilityEngineeringCloud SecurityKubernetesautomationGitHub Actionsdesigningsimilar)buildingISO 27001fintechPythonGolangdesignGitKafkaCI/CDOWASPRustAWSandGenerative AITerraformFulltime
Key highlights
- $5,000 - $9,500 USD gross per month
- 6+ years of experience
- Fully remote
- Strong proficiency in Golang and Python
Role overview
Sezzle is seeking a hands-on Senior Software Engineer, Security Platform, to build and own the platform the security team runs on. This is a development role focused on designing, building, and operating services in Go and Python on Kubernetes, including the services that discover, scan, triage, and route security findings, the NATS-based event platform, and the CI security gates. Reporting to the Director of Information Security, the role emphasizes AI-assisted engineering to build reusable agentic workflows that multiply team coverage. The goal is to make security systems fast, low-noise, and reliable enough to be trusted by default without slowing delivery.
Responsibilities
- Design, build, and operate security engineering services primarily in Golang and Python, on AWS and Kubernetes: new services where the programme needs them, and the upkeep, hardening and retirement of the existing ones.
- Own the event-driven platform between the security services: the NATS bus, its contracts and consumers, delivery guarantees and observability — so a finding, an inventory change or an alert reaches every service that acts on it.
- Integrate the platform end-to-end: scanners → finding system-of-record → tickets → metrics, so remediation state is visible and exam evidence is a by-product of engineering.
- Own delivery of the security gates — SAST, SCA, secret detection, container and IaC scanning: scanner selection and tuning, suppression workflow mechanics, false-positive burn-down, and the rollout tooling that takes a gate from advisory reporting to enforcing without blocking delivery.
- Build agentic security workflows: CI review agents, automated finding triage and verification, remediation helpers — tooling other engineers actually adopt.
- Build the triage-to-remediation automation: validate true positives by hand enough to prove the tooling right, then automate the loop — reproduction context, fix guidance, and routing to the owning teams and to vulnerability-management operations.
- Participate in threat modeling and secure design reviews for the services you build and the pipelines you own.
- Participate in the on-call rotation for the services you own.
Requirements
- 6+ years of professional software engineering experience, including significant backend experience.
- Deployed significant changes to a production application in the past 30 days.
- Strong proficiency in Golang, plus working proficiency in Python.
- Hands-on experience building and operating event-driven or message-based systems (NATS, Kafka, or similar): contracts, idempotent consumers, replay, back-pressure.
- Hands-on experience building and operating CI/CD pipeline tooling — jobs, shared templates, runners — GitLab CI at fleet scale is a strong plus.
- Hands-on web application security knowledge: the OWASP Top 10 in real code — able to find these issues, fix them yourself, and encode the detection so they stop recurring.
- Hands-on experience with SAST, SCA, and secret-scanning tooling (e.g., Semgrep, CodeQL, Snyk, Trivy, Grype, gitleaks), including tuning them to a signal-to-noise ratio developers will tolerate.
- Demonstrated AI-forward engineering: you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your development work today, have opinions grounded in practice about where it helps and where it doesn't, and have built agentic workflows that other engineers adopted.
- Working knowledge of AWS and Kubernetes as deployment targets for the services you build.
Nice to have
- Experience in fintech, payments, BNPL, or consumer lending, especially with systems in cardholder-data or regulated scope.
- Working knowledge of PCI DSS and SOC 2 as they apply to software development and change management — the platform you build is what produces that evidence.
- Software supply-chain integrity: SBOM pipelines, dependency governance, artifact signing and provenance (Sigstore, SLSA).
- Familiarity with policy-as-code and admission control (OPA, Kyverno, conftest) — your gates compose with the cluster's runtime policy-enforcement layer.
- Exposure to bug bounty or external vulnerability report triage — enough to know what the automation you build has to get right.
- Experience with threat modeling at a system level.
Benefits
- Fully remote role. Work from where you do your best work.
Additional details
- The salary range for this role is $5,000 - $9,500 per month (Gross in USD) based on experience level.
- You will report to the Director of Information Security and work alongside the engineers who own detection and response and network and zero trust.
- Technology Stack Languages: Golang, Typescript, Python
- Technology Stack Frontend: Typescript - React and React Native
- Technology Stack Backend: Golang
- Technology Stack Database: MySQL, Postgres, Elasticsearch
- Technology Stack DevOps & Cloud: AWS, Kubernetes
- Technology Stack Version Control: Git
- Technology Stack CI/CD: Gitlab
- Technology Stack Testing: Developer and AI-driven, focus on automated end-to-end, integration, and unit tests
- Open Source: Sezzle is focused on using open source, and we build what we can before buying!
- Culture/About You: You measure yourself by other teams' code; you'd rather ship a gate than publish a policy; relentlessly high standards; not bound by convention; need action/speed; earn trust; do not compromise for the sake of social cohesion; deliver results.
- #Li-remote #Full-time
- Originally posted on Himalayas