Staff Security Engineer

We're hiring Float's first Staff Security Engineer, to own the technical direction of our security platform: application, infrastructure and identity security. Our security team is small and builds more than it buys. We write our own detections, run our own agent platform, and fix things at the root. Float's engineers build quickly and we don't run big security gates, so your job is to make the secure path the easy one.

You'll take a complex area of security, own it from end to end, and design the fixes alongside engineering, then drive them through to adoption across product teams. You'll look ahead too, setting up the foundations for new products, and for how we run AI tools safely, well before teams start building. You'll work as a peer to our staff and principal engineers, and explain big architectural changes and the risk behind them in a way that moves everyone toward the outcome.

Responsibilities:

• Own the technical strategy for security platform work: set standards, write down decisions, and explain risk to leadership in business terms.
• Own a major area of security end to end, from the risks and the plan through to shipped improvements.
• Build security primitives into our core backend (Python and Django), such as default-closed authorization and tenancy scoping, then lead adoption across every product team.
• Shape our customer identity platform: passwords, passkeys, SSO/SAML and machine-to-machine authentication.
• Threat model and review the architecture and code of new products and large changes, and help redesign things so they are better, not only point out what's wrong.
• Secure how we use AI: our internal agent platform, MCP gateways, and the data that flows through them.
• Look ahead and put security foundations in place about six months before teams start building in a new area.
• Lead multi-quarter efforts across several engineers as the security voice in the room, with minimal drag on engineering delivery, and mentor engineers on and off the security team.
• Present significant architectural and engineering changes, with the risks, to engineers and leaders so they understand and act.
• Harden our CI/CD and software supply chain, and turn controls into code (infrastructure as code, policy as code) instead of manual work.
• Help secure the platform as we move to Kubernetes: workload isolation, network policy, IAM and secrets.
• Build in-house tools and capabilities where it makes more sense than buying them as Float grows.
• Give timely, practical advice early in the process so teams spend less time waiting on security.
• Identify blind spots across the company and help set priorities for where security should invest.
• Use AI tools to move faster on threat modelling, reviews, investigation and building.

Requirements:

• 8+ years of experience as a software engineer or security engineer, at a company large enough that you built systems and tools yourself.
• Depth in at least one of application security, identity, or cloud and infrastructure security, and credibility across the rest.
• You ship production code to fix what you find, in Python and Django or a similar web stack.
• Hands-on experience designing and building security controls, tooling or systems, and the engineering depth to be a peer to staff-level engineers.
• You've led a multi-quarter, cross-team technical change through influence, not authority.
• A real interest in security, shown by what you've built, learned or owned.
• Experience owning a complex technical problem and shipping it from start to finish.
• Clear, direct writing and communication with engineers and leaders, able to explain architecture and risk in business terms in a way that leads to action.
• Practical examples of using AI in your engineering or security work.

Nice to have:

• Fintech, payments or PCI DSS experience.
• Building or running an identity platform at scale.
• Detection engineering or incident response.
• Experience securing LLM or agent systems.
• Experience with container and Kubernetes infrastructure security.
• Experience bringing a bought tool in-house.