Staff Security Engineer

About Cari

The Cari Network is building a blockchain-based payment system powering real-time, 24/7 movement of digital money across the traditional finance and digital asset ecosystems. A pre-launch startup, we’re creating an entirely new category of financial infrastructure that brings cash on chain through tokenization while powering the full spectrum of payments for our network — banks and most importantly, the customers they serve.

About the Role

You'll be a foundational security hire reporting directly to the CISO, building our security program from the ground up with high autonomy on a small team. Our platform processes tokenized bank deposits, turning payment instructions into immutable on-chain records. You'll secure every step of that path: identity, cloud, and detection, through our institutional custody integration, all the way to on-chain finality on our private ZKsync-based L2.

What You'll Do

• Own identity end to end. Roll out SSO and automated joiner-mover-leaver lifecycle management across corporate and production systems. Design the role and entitlement model, run periodic access reviews, and make least privilege the default.

• Secure blockchain and signing infrastructure. Partner with engineering to threat-model and harden our Solidity smart contracts, private ZKsync L2 nodes, and custody platform integrations. Define upgrade governance for on-chain systems.

• Build detection from the ground up. Deploy and own our SIEM, onboarding and normalizing logs across cloud, identity, endpoint, and application layers. Build high-signal detections for authentication abuse, control plane activity, privilege escalation, data movement, and anomalous transactions. You own alert quality, not alert volume.

• Lead incident response. Serve as technical lead for alerting, vulnerability management, and threat response. Write containment runbooks, drive investigations through postmortem, and feed lessons back into detection.

• Harden AWS. Enforce least-privilege IAM, network segmentation, and secrets management across ECS/EKS, MSK, and RDS.

• Make security part of shipping. Build automated security gates into CD pipelines and developer workflows, so security keeps pace with delivery.

• Drive compliance readiness. Work with the CISO to implement and document controls for bank-level governance, third-party risk, and audits such as SOC 2 Type II.

Qualifications

• 8+ years in information security, DevSecOps, or infrastructure security.

• Deep ownership of at least two of these areas, with hands-on experience in the third:

  • Enterprise IAM: SSO, federation, automated provisioning and deprovisioning, role and entitlement design, and access reviews.

  • SIEM and detection: deployment, tuning, log onboarding, and detection authoring. You can point to detections you've written and explain how you kept them useful.

  • AWS security: ECS or EKS, MSK, RDS, IAM, VPC, and Secrets Manager.

• Experience securing EVM-compatible blockchain or Web3 infrastructure.

• Experience securing CD pipelines (GitHub Actions or equivalent) and containerized workloads.

• Incident response leadership.

• Comfort working with high autonomy on a small team building a security program from scratch.

Nice to Haves

• Solidity smart contract reviews, including upgradeable proxies (such as UUPS) and role governance.

• Defensive knowledge of L2s, cross-chain bridges, ZK rollups, and EVM transaction mechanics (ABI encoding, calldata validation, nonce management, event log integrity).

• Key management, custody APIs (Fireblocks, Turnkey, Fordefi), MPC signing, or real-time Web3 threat detection and transaction circuit breakers.

• Detection-as-code: version-controlled, tested detections mapped to a framework.

• Terraform, including auditing environments and codifying secure baselines.

• U.S. banking regulation (FFIEC), or SOC 2 Type II and ISO 27001 audits.

What We Offer

• Competitive base salary, bonus, and equity

• Full medical, vision, dental benefits

• 401(k) with company matching

• Flexible PTO in a remote-first environment

• Opportunity to shape a market-defining protocol with an experienced founding team

Security Responsibilities

Applies to all Cari employees

• Comply with all Cari information security policies, including the Acceptable Use Policy, and complete required security awareness training.

• Protect the confidentiality, integrity, and availability of Cari systems and data, including bank-partner and customer information, consistent with least-privilege access principles.