Security Engineer - Drivetrain

Drivetrain is on a mission to empower businesses to make better decisions with its financial planning & decision-making platform. A remote-first company headquartered in the San Francisco Bay Area, Drivetrain was founded in 2021 by ex-Googlers and is backed by leading venture capital firms.

Drivetrain provides a great culture for its employees to thrive in and be happy:

• Remote-friendly: We bring together the best and the brightest, no matter where they are, and provide a great degree of autonomy. We trust our people.
• Open & transparent: We know that when our creators have access to all the information they need, their best work will emerge.
• Idea-friendly: We provide an environment to explore new ideas, to take risks, to make mistakes, and to learn, so you can succeed. Anyone in the company can come up with great ideas and become a catalyst for positive change. We let the best ideas win.
• Customer-centric: We follow a product-led growth strategy, continuously learning from our customers and collaborating to build amazing software.

The Role

You will own Drivetrain's security posture across our product, cloud infrastructure, and internal systems. Working closely with Engineering, DevOps, and Compliance, you will ensure security is built into how we ship, not added after the fact. This is a hands-on role for someone who likes building systems, automating controls, and using AI to scale a small security function well beyond its size. This is high-stakes work: you will protect the data that finance leaders at enterprise companies rely on.

What You'll Do

• Secure our cloud infrastructure (AWS), including IAM, network security, secrets management, logging, and monitoring.
• Embed security into the SDLC through threat modeling, secure code reviews, and SAST, DAST, and dependency scanning in CI/CD.
• Lead vulnerability management end to end, from discovery and triage to remediation with engineering teams.
• Own detection and incident response: build alerting, write runbooks, and lead investigations when something goes wrong.
• Drive compliance programs such as SOC 2 Type II, ISO 27001, and GDPR, and automate evidence collection wherever possible.
• Answer customer security questionnaires and join security reviews with enterprise prospects alongside the sales team.
• Manage third-party and vendor risk, including reviews of the AI and data vendors we integrate with.
• Assess and secure the use of LLMs in our product, covering prompt injection, data leakage, and model access controls.
• Run security awareness for the team and make secure practices the easy default.

What You Bring

• 4 to 7 years of hands-on experience in security engineering, cloud security, or application security, ideally at a B2B SaaS company.
• Strong working knowledge of AWS security services and Infrastructure as Code (Terraform or similar).
• Experience securing web applications and APIs, with a solid grasp of the OWASP Top 10.
• Comfort writing code or scripts (Python, Go, or similar) to automate security tasks.
• Experience supporting SOC 2 or ISO 27001 audits.
• AI fluency is a must, not a nice-to-have. You use AI tools every day to speed up your work, whether that is triaging alerts, reviewing code, drafting policies, or automating compliance evidence, and you can show us how.
• Clear communication, so you can explain risk to engineers, leadership, and enterprise customers alike.

Nice to Have

• Experience securing LLM-powered features or AI agent workflows.
• Exposure to fintech or other products that handle sensitive financial data.
• Hands-on experience with tools such as Vanta, Drata, Wiz, Snyk, or similar.
• Certifications such as OSCP, AWS Security Specialty, CISSP, or CCSP.
• Experience as the first or founding security hire at a startup.