> Markdown version of [/jobs/ext/3475707-software-engineer-risk](https://www.wearedevelopers.com/jobs/ext/3475707-software-engineer-risk). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Software Engineer - Risk - **Company:** CARDLESS, INC. - **Location:** San Francisco, CA, United States (Remote available) - **Experience:** Expert - **Salary:** $190,000.0 - $295,000.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Application Programming Interfaces (APIs), Distributed Systems, Fraud Prevention and Detection, Python (Programming Language), Anti-Phishing, Backend - **Published:** September 24, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=be2bf8ccc438f2a3 ## About the Role * 6+ years building production backend systems, with meaningful time in fraud, payments risk, or trust and safety engineering * You've built risk systems as an engineer: decisioning services, rules engines, real-time scoring, step-up orchestration. Not analyzing fraud or handing models off for someone else to deploy * Strong distributed systems and API fundamentals in a modern backend language (we're primarily Java, with Python for data work) * You think in blast radius: what if this rule is wrong, how fast can we turn it off, how will we know? And you're steady in an incident ## Description As a Risk Engineer at Cardless, you'll own the systems that decide whether to trust a person, a device, or a transaction. We're bringing fraud decisioning in-house. Much of it runs through vendor platforms today, which serve us well but leaves the decisions, the tuning, and the visibility outside systems we control. You'll build that layer: risk rules as versioned code, controls with kill switches, and detection our analysts can watch in real time. This is a senior-to-staff role with real architectural ownership, working directly with our Risk and Fraud Operations teams. What you'll do * Build the risk decisioning layer for card authorization and mobile wallet provisioning: what gets approved, stepped up, or frozen * Move fraud logic out of vendor dashboards into one testable control plane, with shadow mode, staged rollout, and kill switches * Build real-time detection and alerting across velocity, cross-provisioning, and device signals, plus a lockdown posture for active attacks * Gate servicing changes (address, phone, email, reship) on risk evaluation, and ship the tooling our fraud analysts work in daily, * Card issuing: auth-time decisioning, tokenization, wallet provisioning, disputes, and PCI knowledge would all be huge pluses * Account takeover and step-up auth: OTP, SIM swap, phishing resistance, device fingerprinting, passkeys, IDV * You've worked at a risk or identity vendor (Sardine, Sift, Unit21, Feedzai, Alloy, Persona) and want the issuer side This role isn't a fit if * You want to build models rather than the systems that run them * You'd rather tune an established platform than design one * You want clean separation from operations, or to work remotely Why this role Fraud is one of the few problems in fintech where the adversary adapts to you personally, in days, and one of the few where good engineering is immediately impactful. You can watch a control go live and watch the losses stop as fast as you can ship. We're looking for the founding risk engineer who we can eventually build the team around at Cardless. You'll decide what the platform is, what belongs in code versus vendor config, and what "defended" means here across every brand we launch. The second-order effect is a better product: tighter controls, done well, mean fewer false positives and less friction for the customers who deserve none.