安全工程师负责人
Lead Security Engineer
### 关于Prelim
Prelim 为社区银行和信用合作社构建数字开户基础设施。我们在种子资金支持下，连续四年实现了100%以上的ARR增长，我们的平台是银行客户开户流程中的关键路径。当我们的系统出现故障时，银行无法为客户开设账户。
我们是一个小团队。你将是我们的第一位专职安全人员，帮助定义下一代银行的安全计划。
### 你将负责
- 安全的SDLC：依赖项扫描、静态分析、高风险变更的安全审查，以及协调年度渗透测试。教会工程师在问题出现前自行发现。
- 与DevOps合作处理IAM、密钥管理、网络架构、日志记录和检测。
- 政策、风险评估和路线图。决定像我们这样规模和风险水平的公司真正需要什么，并向审计师、银行家和内部人员辩护这一理由。
- 负责安全问卷、供应商风险评估和客户安全审查。银行会进行严格的第三方风险管理（通常依据FFIEC指南）。
- 终端设备管理、访问审查、防钓鱼能力、离职流程规范。这些是问卷中首先询问的不起眼但重要的内容。
- 全程负责SOC 2 Type II：控制设计、证据收集、审计师管理。
- 负责事件响应，从编写计划、组织演练，到在真实事件发生时领导响应。银行合同中有数据泄露通知的要求。你将对此了如指掌。
### 我们寻找的人
- 5年以上安全工程经验，具备应用安全、云安全和合规方面的广泛知识。
- 实战能力强：你能阅读代码、编写脚本并自行配置云控制。
- 曾负责或深度参与过SOC 2审计（或ISO 27001/同等标准）
- 有应对企业或金融机构安全审查的经验。
- 强大的书面沟通能力。
- 对比例性有判断力：你知道在我们这个规模下哪些风险重要，哪些控制措施只是形式。
### 有益的条件
- 金融科技或银行供应商经验；熟悉FFIEC、GLBA或银行第三方风险管理
- 作为首位或早期安全人员的经验
- 检测工程/SIEM经验
- 熟悉核心银行集成或处理PII/KYC数据流
查看英文原文
### About Prelim
Prelim builds digital account-opening infrastructure for community banks and credit unions. We've sustained over 100% ARR growth for four consecutive years on seed funding, and our platform sits in the critical path of how banks onboard their customers. When our system is down, a bank can't open accounts for its customers.
We're a small team. You'd be our first dedicated security hire and help define the security program for the next generation of banking.
### What you'll own
- Secure SDLC: dependency scanning, static analysis, security review of high-risk changes, and coordinating annual penetration tests. Teach engineers to catch issues before you have to.
- Partner with DevOps on IAM, secrets management, network architecture, logging, and detection.
- Policies, risk assessment, and roadmap. Decide what a company our size and risk profile actually needs, and defend that reasoning to auditors, bankers, and internally.
- Own security questionnaires, vendor risk assessments, and customer security reviews. Banks conduct rigorous third-party risk management (often against FFIEC guidance).
- Endpoint management, access reviews, phishing resistance, offboarding hygiene. The unglamorous stuff that questionnaires ask about first.
- Own SOC 2 Type II end to end: control design, evidence collection, auditor management.
- Owning incident responsne, from writing the plan, run the tabletops, and lead if it's ever real. Banks have breach-notification expectations in their contracts. You'll know them cold.
### What we're looking for
- 5+ years in security engineering, with breadth across appsec, cloud security, and compliance.
- Hands-on: you can read code, write scripts, and configure cloud controls yourself
- You've owned or heavily contributed to a SOC 2 audit (or ISO 27001 / equivalent)
- Experience answering enterprise or financial-institution security reviews.
- Strong written communication.
- Judgment about proportionality: you know which risks matter at our scale and which controls are theater
### Nice to have
- Fintech or banking-vendor experience; familiarity with FFIEC, GLBA, or bank third-party risk management
- Experience as a first or early security hire
- Detection engineering / SIEM experience
- Familiarity with core banking integrations or handling of PII/KYC data flows
### About Prelim
Prelim is a San Francisco and New York City-based startup that operates with fully remote positions across the US, helping banks onboard their customers. Our platform is designed to streamline the account opening process for both consumers and businesses, accelerating speed-to-market and enhancing the customer experience for financial institutions. If you’re excited to help shape the future of the banking industry, we encourage you to apply and join our team at Prelim. We are seeking individuals who are driven, ambitious, and eager to make a real impact in a traditional industry ready for technological innovation.
We offer equity, a sponsored 401K, parental leave, and fully paid health, vision, and dental insurance. Additional benefits include unlimited PTO, a remote work stipend, a life-style stipend, and twice-yearly company retreats.
Prelim values diversity and inclusion; people of all backgrounds are welcome to join our mission to transform banking.