Member of Technical Staff (Security)
First dedicated product security engineer owning the security boundary end-to-end for an identity verification platform and AI agent for financial crime investigations, working across Nitro Enclave vaults, AI sandboxes, and compliance programs (SOC 2, PCI DSS, ISO 27001).
- Compensation
- $180K–$260K / yr
- Location
- New York City
- Work setup
- Onsite
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- 1+ years
- Category
- Software engineering
- Posted
Skills
Must have
- 5+ years of hands-on security engineering (application security, infrastructure security, or both)
- Deep understanding of encryption, key management, and access control sufficient to audit a production system holding millions of PII records
- Knowledge of how code execution environments get escaped, least privilege enforcement on ephemeral compute, and cross-tenant leak vectors
- Offensive work experience: pen testing, threat modeling, or vulnerability research
- Hands-on AWS security experience (IAM, VPC, KMS, CloudTrail, GuardDuty)
- Experience through a SOC 2 or PCI DSS audit, translating real controls into evidence an auditor accepted
- Track record of shipping self-initiated security fixes
Nice to have
- Experience securing AI/LLM agent systems or autonomous code execution
- Knowledge of trusted execution environments (AWS Nitro Enclaves, Intel SGX)
- Experience with document fraud detection or adversarial robustness of ML pipelines
- Rust development experience
- Experience building security tooling (SAST, DAST, CI/CD gates)
- Familiarity with the KYC and identity verification space
Full description
Footprint is the agentic platform that learns your compliance program and runs it end to end.
Compliance teams at banks and fintechs are drowning in financial crimes investigations. Transaction volumes are surging, regulators keep raising the bar, and the work still runs on manual review queues stitched together from legacy vendors. Percy, our agentic system, learns each team's procedures and makes the same calls their analysts would: clearing false positives, escalating real risk, writing the case narrative, and documenting every decision for audit. It cuts review workloads by 70%+.
The harder problem is underneath. Every investigation is grounded in the data sources compliance teams already trust, and every case commits to an organizational memory that compounds — so a pattern one analyst caught in March surfaces automatically in October, across KYC, EDD, sanctions, and monitoring. Whether the team is five analysts or 500, they share one brain. Every memory carries provenance. Agents propose; humans approve. That's four years of identity infrastructure sitting under the agent, and it's the part nobody can bolt on later.
We're backed by QED, Index, and Box Group, and trusted by FDIC- and OCC-regulated banks plus fintechs like Bilt, Nuvei, and MoonPay. We 5x'd revenue last year. The team is small, senior, and ships fast.
The Role
Footprint sells trust to banks and fintechs: verify an identity, vault the PII, and prove to an auditor that every step was done correctly. The architecture reflects four years of that job. Identity records live in an AWS Nitro Enclave-backed vault as an append-only ledger, and our SDKs collect sensitive data straight from end-user devices.
This year the surface changed. Percy, our AI agent platform, now runs AI-powered agents in isolated Modal sandboxes that make compliance and risk decisions on live PII. An agent that acts on real identity data raises new questions: what the sandbox can reach, and how does a person's most sensitive data stay safe while an AI system works on it. At the same time, our customers' diligence teams keep asking harder security questions, because our audit trails are part of what they're buying.
Footprint was built with strong security foundations, but we're hiring the first person to fully own the product's security boundary end to end. This is an engineering seat: you'll spend most of your time in the product, with security as your lens.
You'll inherit a real security architecture: hardware attestation, KMS-based key management, an audit ledger designed to be tamper-evident, secret management, and compliance programs that already pass their audits. Assessment, hardening, security tooling, and the standards engineering builds against all become yours.
You'll report directly to the Head of Engineering - Elliott Forde.