Accelerate Global Payments as a Staff Application Security Enginee
Location: (Consider adding a specific location or "Remote/Hybrid" if applicable)
About Rain: Pioneering the Future of Finance
Imagine a world where money moves instantly, compliantly, and freely across borders. At Rain, we're not just imagining it – we're building it. As the global stablecoin payments platform, we empower enterprises, neobanks, developers, and even AI agents to move, store, and utilize stablecoins with unparalleled speed and compliance. Our cutting-edge technology fuels global payment cards, rewards, on/off-ramps, wallets, and cross-border rails.
As a proud Visa and Mastercard Principal Member, Rain issues cards accepted at over 175 million merchant locations in 220+ countries. Trusted by more than 100 organizations worldwide, we deliver secure, scalable infrastructure purpose-built for stablecoins, making global transactions effortless and immediate.
This is your chance to deliver massive impact within a hyper-growth company, backed by top-tier investors in fintech, crypto, and SaaS. With a recent $250M Series C led by ICONIQ, valuing Rain at $1.95B, we're scaling rapidly. If you're curious, bold, and driven to shape a borderless financial future, we invite you to join us.
Our Ethos: Empowering Innovation, Fostering Growth
We champion an open and flat organizational structure, where every team member, regardless of level, has the freedom to explore ideas, challenge norms, and directly impact our roadmap and vision. At Rain, your growth isn't just encouraged – it's woven into our DNA, allowing you to shape a role that truly aligns with your ambitions.
The Security Engineering Team: Building Trust from the Ground Up Running our own AI-driven red team against Rain's entire codebase and cloud infrastructure. While our blockchain work is covered, this role owns everything else: safeguarding the backend services, APIs, cloud environment, and edge defenses that move real money for real customers. We work hand-in-hand with Security Operations, providing them with high-quality findings for swift remediation and clear configuration rules to build robust detection capabilities. About the Role: Staff Application Security Engineer – The Ultimate Quality Bar What You'll Do: Drive Security Excellence Vulnerability Triage & Remediation: Master the art of reviewing red team findings. You'll reproduce vulnerabilities, eliminate false positives, accurately set severity levels, and craft crystal-clear tickets that enable engineers to fix issues without a meeting. You'll also continuously refine our scoring methodology. What We're Looking For: Your Expertise & Impact Experience: 4+ years of hands-on experience in application security, product security, or security-minded backend engineering roles. Bonus Attributes: Stand Out Background in Fintech, payments, or card issuing (PCI DSS knowledge is a significant plus). Beyond the Code: Our Commitment to Your Well-being Unlimited Time Off: Recharge when you need to! While vacation is unlimited, we require all Rainmakers to take a minimum of 10 days off each year.
Join a lean, high-impact Security Engineering team obsessed with one critical question: "Was it built right?" We’re not just finding bugs; we’re defining the gold standard for security. Our dynamic approach includes:
Acting as a critical gatekeeper, reviewing and approving pull requests before they merge, stopping issues before they reach production.
Crafting and enforcing robust security baselines for every system configuration.
As our Staff Application Security Engineer, you won't just find vulnerabilities – you'll be the ultimate arbiter of what's real, how severe it is, and what gets fixed before launch. You are Rain's non-chain application security expert, setting the quality bar for every finding we produce. You'll hold the line with engineers when it matters most, building strong relationships that foster agreement, not just compliance.
System Hardening: Proactively harden our critical backend services and APIs, with a keen focus on the money-moving paths. Often, you'll be the one writing and implementing the fixes yourself.
Edge Defense Ownership: Take full ownership of our edge defenses, including DDoS protection, rate limiting, WAF rules, and advanced abuse controls.
Automated Security Baselines: Define and implement secure configuration baselines across our cloud (GCP), codebase, and SaaS applications, translating them into robust, automated checks.
PR Security Gate Enhancement: Continuously evolve and strengthen our PR security gate, blocking more bugs and architectural flaws before they ever merge into the main branch.
Attack Surface Management: Own attack surface coverage, conducting thorough threat models and architecture reviews for all new and high-risk systems.
Security Tooling: Research, evaluate, test, and strategically select the best security tools – whether we build, buy, or adopt open-source solutions – ensuring maximum impact and efficiency.
Leadership & Influence: Proven ability to own critical security decisions. You can confidently articulate the need for design changes to senior engineers while maintaining strong, collaborative working relationships.
Technical Acumen: The ability to quickly dissect unfamiliar codebases (especially TypeScript/Node.js) to pinpoint critical bugs, discerning real threats from scary-sounding but benign findings.
Cloud & Infrastructure Security: Practical, hands-on experience with cloud security (ideally GCP), Terraform, and edge defenses such as WAFs and rate limiting.
Strategic Thinking: Experience with threat modeling and architecture reviews. You've successfully run tool bake-offs and have the courage to deprecate tools that don't deliver sufficient value.
Automation & Efficiency: A strong bias towards shipping automated checks over writing lengthy documentation, coupled with a pragmatic approach to leveraging AI tools without blind trust.
Prior experience in penetration testing, bug bounty programs, or red teaming.
Experience building security scanners, static analysis rules, or LLM-based code review tools.
Specialized background in AI security for agents and agentic payments, or corporate security alongside IT.
At Rain, we believe that high performance thrives on a foundation of health, happiness, and work-life balance. We're dedicated to creating an environment where you can truly flourish:
Flexible Working: We support a flexible workplace. Work from home, join us in an office, or embrace a hybrid model – whatever empowers you to be your most confident and productive self. New Rainmakers receive a stipend to create a comfortable home workspace.
Comprehensive Benefits (US): We cover 95% of your health, dental, and vision plan costs and 90% for your dependents, alongside a 100% company-subsidized life insurance plan.
401(k) with Company Match: Plan for a secure future with our 401(k) program, featuring a generous 4% company match.
Equity Plan: Every Rainmaker receives an equity option plan, ensuring we all share in Rain's success.
Health & Wellness Stipend: Invest in yourself! Receive a monthly stipend for eligible health and wellness expenses like gym memberships, fitness classes, massages, or anything else that recharges your mind and body.
In-Office Meals: For those working from the office, enjoy complimentary lunch and dinner covered via a DoorDash credit.
Team Summits & Offsites: Build strong bonds and a shared vision through regular team and company offsites, both domestic and international.