Security Engineering (w/m)

Security Engineer Department: Engineering
Location: Remote (US)
Type: Contract-to-hire
Remote (US). You'd own and advance the security program for a bitcoin custody platform, lead incident response, build AI-driven continuous pen testing, and still ship product code. Two-thirds security, one-third engineering. About Onramp Onramp is building the money platform of the future for individuals, businesses, and financial institutions: We are a FinCEN-registered Money Services Business, run an active SOC 2 Type II program, and work directly with banks, custodians, and financial institutions. Advance our controls across identity, endpoint, network, email, and browser layers, and handle the change management that gets a small team to adopt them
Build AI-driven offensive testing: continuous, agent-assisted pen testing and attack simulation that complements our manual program and feeds findings straight to engineering
Harden the developer pipeline and cloud posture across GitHub, GCP, and Vercel: supply chain scanning, secrets management, IAM least-privilege, required checks on auth, withdrawal, and KYC paths
Run access reviews, service account inventory, vendor risk reviews, and SOC 2 evidence as part of the work rather than after it
Govern our AI-native toolchain with a lightweight pre-adoption review for new connectors and agents
Ship product code in our TypeScript/Next.js and Elixir/Phoenix services
Offensive-minded, with pen testing experience and real interest in making it continuous with AI agents

• A working software engineer on at least one side of a modern stack (React/Next.js and TypeScript, or Elixir/Phoenix, Node, or comparable)
• Deep on identity, endpoint, and cloud security in a Google Workspace, GitHub, GCP, and Vercel environment, and opinionated about right-sizing tooling for a small team
• AI-driven supply chain attacks, session theft, OAuth phishing, deepfake social engineering
• Insanely AI-native, with strong views on securing agents without adding friction
• Nice to Have Bitcoin custody experience (multisig, PSBT, key-agent architectures), Elixir/Phoenix, agentic security tooling, GCP Security Command Center or Wiz, Terraform, OSCP or equivalent, CTFs or public disclosures.

Stakes: we custody bitcoin for HNW clients, RIAs, and institutions. The AI moment: budget and mandate to push AI-native security on both the defensive and offensive side
How We Work Remote-first (US), high-trust, low-ceremony. Small pods, direct communication, written culture, biweekly all-hands with live AI demos. We care about output, not hours.
This role starts as a remote contract with a clear path to full-time and equity once fit is confirmed on both sides.
The Process Intro call, technical conversation with the Engineering Lead and CCO, a working session (bring your AI toolkit), founder conversation, offer.
Flat structure, builder-first execution culture
Competitive compensation, with meaningful equity on conversion to full-time
How to Apply Send your resume and a short intro video to covering:

An incident you helped run and what changed because of it
One AI-leveraged workflow you've built or wished you had
Application — Security Engineer