Senior Security Engineer

Payments security gets complicated quickly. Cloud infrastructure, application security, PCI scope, cryptographic keys and the software supply chain all matter, and this role sits across all of them.

You’ll partner directly with engineers on how products are designed and shipped, while owning security across AWS infrastructure and the corporate environment. This isn’t a security role built around producing findings and handing them over. You’ll be expected to understand the problem technically, influence the architecture, and drive remediation through to completion.

The breadth is deliberate. One week could involve reviewing the security model for a new payments feature, the next could mean coordinating a pentest, tightening CI/CD controls, working through PCI architecture or supporting an HSM key operation.

What you’ll be working on:

• Partnering with engineering teams on threat modelling, secure design and implementation
• Securing AWS infrastructure and employee workstations
• Leading security incident response and subsequent remediation
• Owning vulnerability management across scanning, pentests and bug bounty findings
• Hardening CI/CD pipelines and the wider software supply chain
• Working with engineering on PCI architecture, including scope, data handling and secure SDLC
• Supporting HSM operations, key exchanges and key injections
• Building and maintaining technical controls for PCI DSS and SOC 2
• Supporting audit fieldwork and customer security reviews
• Defining security controls and guardrails around internal AI tooling

• 5+ years of hands-on security engineering experience
• Strong AWS security experience in a production environment
• Software development experience with Java
• Experience finding and actually remediating vulnerabilities, not just reporting them
• Hands-on incident response experience
• Working knowledge of PCI DSS and security controls within regulated environments
• Practical cryptography and key-management experience
• The ability to communicate security decisions clearly with engineers and non-technical stakeholders

Useful, but not essential:

Terraform, CI/CD security, Okta, CrowdStrike, Palo Alto Prisma Access, Sonatype Nexus, bug bounty or pentesting experience, plus certifications such as AWS Certified Security - Specialty or CISSP.

Storm2’s client is a San Francisco-based payments infrastructure company building technology used by businesses ranging from startups through to public companies. Founded in 2015, the business now processes tens of billions of dollars annually across online and in-person payments and has raised more than $200m.