Principal Security Engineer

Principal Security Engineer

Join an innovative financial technology organization building secure, scalable infrastructure that expands access to global investment markets. As a Principal Security Engineer, you will provide technical leadership in designing and implementing security capabilities across cloud infrastructure, trading platforms, applications, and corporate systems. You will combine hands-on engineering expertise with architectural vision to protect sensitive data, strengthen security operations, and support demanding regulatory requirements. Working across Engineering, IT, Risk, and Compliance, you will develop automated security controls and resilient platforms that enable business growth without compromising reliability. You will also mentor engineers, influence technical strategy, and lead complex initiatives from initial design through production deployment. This is an opportunity to make a measurable impact in a high-performance fintech environment where security, innovation, and operational excellence are essential.

Accountabilities

• Security architecture and technical leadership: Design and implement reusable security patterns, automated guardrails, and technical standards across product infrastructure and corporate environments. Lead complex engineering initiatives from architecture and testing through deployment, maintenance, and continuous improvement.
• Cloud and infrastructure security: Strengthen security across AWS services, Kubernetes and EKS, EC2, DynamoDB, and colocated infrastructure by implementing least-privilege access, workload identity, network segmentation, encryption, and secure data access while preserving availability and trading performance.
• Endpoint, identity, and SaaS security: Harden Windows and macOS environments, optimize endpoint protection, and automate identity and device controls using platforms such as Okta and JumpCloud. Improve privileged access management, phishing-resistant authentication, and secure configurations across corporate SaaS applications.
• Application and container security: Integrate threat modeling, API security, automated security testing, container image signing, policy enforcement, and runtime protections into development pipelines, CI/CD, and GitOps workflows.
• Vulnerability and exposure management: Automate source-code, dependency, container, and infrastructure scanning. Collaborate with Engineering and IT to prioritize remediation, validate fixes, and implement preventive measures that reduce recurring vulnerabilities.
• Security operations engineering: Build, integrate, and maintain security platforms, including SIEM, SOAR, endpoint protection, and vulnerability management systems. Establish reliable provisioning, monitoring, documentation, and support procedures.
• Detection and incident response: Engineer telemetry collection, normalization, and enrichment pipelines. Partner with Security and Threat Operations to develop detection logic, validate analytics, automate response playbooks, support threat hunting, and lead post-incident security improvements.
• Compliance and regulatory automation: Translate requirements from Legal, Compliance, and Governance, Risk, and Compliance (GRC) teams into tested technical controls. Support regulatory obligations, including SEC Rules 17a-3 and 17a-4, automate evidence collection, and facilitate audits and regulatory examinations.
• Data security and privacy: Develop and maintain capabilities for data discovery, classification, access control, encryption, retention, and secure deletion to support GDPR and other applicable privacy and data protection requirements.
• Cross-functional collaboration and mentoring: Advise business leaders and engineering teams on security risks and technical trade-offs. Conduct architecture and code reviews, mentor engineers, document technical decisions and operational runbooks, and promote secure engineering practices throughout the organization.

Requirements

• Professional experience: 10+ years of relevant experience in security engineering, software engineering, or infrastructure engineering, with a demonstrated record of leading complex security initiatives from architecture through production operations.
• Cloud and container security: Deep practical expertise in AWS and Kubernetes security, including IAM, workload identity, networking, container protection, and secure access to sensitive data.
• Endpoint and identity management: Strong working knowledge of Windows and macOS security, endpoint protection, identity management, and SaaS security. Experience with Okta, JumpCloud, or comparable platforms is preferred.
• Software development and automation: Strong programming skills in Python or a comparable language, combined with practical experience using Terraform, infrastructure as code, CI/CD pipelines, GitOps, and security-as-code practices.
• Security platform engineering: Experience building and operating security platforms, telemetry pipelines, detection systems, and automated incident response capabilities, with an emphasis on data quality, reliability, scalability, and maintainability.
• Architecture and problem-solving: Sound architectural judgment, advanced troubleshooting skills, and the ability to assess risk, prioritize competing initiatives, and deliver effective solutions in complex technical environments.
• Leadership and communication: Demonstrated ability to influence technical and business decisions across teams, communicate security concepts clearly, mentor technical colleagues, and collaborate effectively with Engineering, IT, Risk, and Compliance.
• Regulatory and compliance knowledge: Experience in regulated financial services or another environment with demanding availability, security, and audit requirements. Familiarity with NIST Cybersecurity Framework (CSF) or NIST SP 800-53 is required. Experience with brokerage operations, SEC or FINRA regulations, and privacy compliance is preferred.
• Education and certifications: A bachelor's degree in a related field or equivalent practical experience. Relevant security, AWS, Kubernetes, or GIAC certifications are advantageous.
• AI and continuous improvement: An interest in leveraging AI tools and emerging technologies to improve engineering productivity, reduce operational friction, and strengthen security outcomes.
• Work location and authorization: Candidates must reside in an approved U.S. location: New York City, Chicago, Austin, Dallas, Denver, Miami, the San Francisco Bay Area, or Seattle. Candidates based in New York City or Chicago must accommodate a hybrid office schedule; other approved locations are remote, with occasional office visits as needed. Applicants must be authorized to work in the United States without current or future employer-sponsored visa support.

Benefits

• Annual base salary: $215,000–$235,000, depending on location, experience, skills, and role-related responsibilities.
• Performance-based compensation: Eligibility for additional bonus compensation.
• Equity: Equity participation as part of the total compensation package.
• Retirement savings: 401(k) plan with employer matching.
• Healthcare coverage: Heavily subsidized medical, dental, and vision insurance.
• Insurance protection: Disability insurance and other applicable coverage.
• Paid time off: Generous paid time off (PTO) and observed company holidays.
• Paid parental leave: Support for employees and their families.
• Wellness reimbursement: Financial support for eligible wellness-related expenses.
• Technology benefit: Company-provided phone.
• Professional development: Personal development allowance to support ongoing learning and career growth.
• Flexible work arrangements: Remote work for eligible locations, with hybrid arrangements for employees based in New York City and Chicago.
• Collaborative culture: Work alongside experienced professionals in a fast-paced fintech environment that values innovation, accountability, inclusion, and technical excellence.