Senior Software Engineer, Security & Data Integrity

Institutional investors entrust Vantage42 with sensitive records: fund statements, cap tables, capital accounts, side letters, K-1s and investment judgments. We need a hands-on engineer who can build software and reason deeply about how evidence, agent actions and customer data remain protected and trustworthy.

Working closely with our CTO and security leadership, you’ll own critical engineering controls across secure execution, per-client application-and-data isolation, source provenance and the release process. You’ll also help strengthen our security assurance and SOC 2 readiness. This is a builder’s role, not a compliance-only role or a generic cloud-security position.

WHAT YOU’LL DO

Engineer trust into the architecture

• Harden customer isolation, authentication and authorization, secrets, encryption, audit trails and access to sensitive documents and derived agent outputs.
• Design safeguards for AI and tool execution: prompt-injection defenses, untrusted-document handling, least-privilege tool access, data-exfiltration prevention and safe human approval gates.
• Threat-model cross-component risks including vendor/model dependencies, service-to-service calls, background agent execution and release propagation across isolated customer instances.

Make financial and agent data verifiable

• Strengthen ingestion and validation pipelines so financial records remain complete, consistent and traceable from source document to typed claim to downstream analysis.
• Build tests, monitors and controls for data lineage, temporal updates, corrections, stale dependencies and integrity of shared agent memory.
• Partner with product engineers on robust data schemas, incident-resistant workflows and reproducible investigation of errors and disputed findings.

Build operational security and deployment discipline

• Improve secure code review, vulnerability management, dependency scanning, production logging, alerting, incident response and disaster-recovery evidence.
• Help maintain controlled rollout and rollback of releases to separately provisioned customer environments, with testable isolation and patch propagation.
• Support security questionnaires, enterprise diligence, control evidence, SOC 2 readiness and independent validation without overstating current certifications or hosting options.
• Contribute to portability and client-controlled deployment design as a future architecture objective, while securing the managed environment we operate today.

WHAT SUCCESS LOOKS LIKE

First 30 days: Ship a meaningful security or data-integrity fix and produce a prioritized threat model covering agent execution, source data and client isolation.

By 90 days: Close major identified gaps; instrument core data-lineage and security controls, with clear evidence suitable for internal review and customer diligence.

By 6 months: Own measurable improvements in secure agent execution, isolation testing, release safety and reliable traceability of consequential financial records.

• 6+ years in production software engineering, including 3+ years of hands-on application, product or cloud security engineering.
• Strong TypeScript/Node.js and/or Python skills; excellent SQL, relational modeling and production data-pipeline experience.
• Practical expertise in IAM, authorization, cryptography and secrets, secure SDLC, OWASP risks, threat modeling and incident response.
• Experience securing managed cloud or SaaS systems with audit logs, monitoring and vulnerability controls; ability to reason across third-party dependencies.
• Ability to implement security improvements in code, not just write policies; an understanding of data provenance and reliability in AI-enabled applications.
• Clear judgment, collaborative communication and a product mindset in a fast-moving engineering organization.

NICE TO HAVE

• Sensitive financial data, fintech, regulated enterprise software, SOC 2 or ISO 27001 audit readiness.
• AI/agent security, prompt injection, retrieval poisoning, temporal databases, provenance graphs or event-driven processing.
• Single-customer deployments, release automation, infrastructure-as-code, confidential computing or sovereign deployment design.
• Security certifications such as CISSP, OSCP or AWS Security Specialty (not required).

Compensation: Base salary $185,000-$235,000

Working model: Full-time, fully remote with meaningful overlap with US Eastern hours; headquarters in New York.

Benefits: Health, dental, and vision insurance; flexible PTO; a small team where your work shapes the product and company.

Underneath the product is a proprietary, stateful agent architecture: specialist analysis coordinated through shared, evidence-backed memory; deterministic financial calculations; and human review at consequential decision points. Each customer runs on a separate application copy and database. We are focused on institutional finance today while building technical foundations that could extend to other institutional domains over time.

We are a seed-stage, fully remote team headquartered in New York, led by fourth-time founder Ben Wald. We pair ambitious engineering with a white-glove, hospitality-first approach to customers.