Senior Security Engineer - Loancrate

What is Loancrate?

We started Loancrate to make home-buying simpler and less expensive for lenders and borrowers. Today, mortgage lenders are stuck running their companies on software products built 20 years ago. These products are slow, unstable, and don't lead to material improvements in efficiency.

Loancrate builds AI-native tooling to automate mortgage workflows. Our ultimate goal is fully automated origination, which has the potential to save lenders over $16B in operating expense per year.

Since starting in 2020, our remote team has enabled our customers to power >$85 billion in new home loans. We are a group of people excited to tackle the complexity of the home-lending industry. We care about collaboration, open communication, and ultimately having fun while we’re building.

The Opportunity

We’re looking for a Senior Security Engineer who makes Loancrate more secure - without making it harder to build here. You’ll build systems, guardrails, and tooling that catch issues early, make secure defaults easy, and help engineers move fast. We handle sensitive personal and financial data, and security is an enabler here, not a gatekeeper.

This is an IC role with broad scope - you’ll work across application security, infrastructure security, compliance, and internal tooling. You’ll write code, ship tooling, and improve our defaults.

What To Expect

As a Senior Security Engineer at Loancrate, you’ll get into the codebase and infrastructure quickly. Within your first month, you’ll be contributing to work such as:

• Conducting a comprehensive threat model of our application and infrastructure layers, identifying the highest-leverage gaps and building a pragmatic remediation roadmap.
• Hardening our AWS infrastructure - IAM least-privilege, secrets management, network segmentation, CloudTrail audit coverage, and GuardDuty alerting - while keeping developer workflows frictionless.
• Integrating security tooling into our CI/CD pipeline: SAST, dependency scanning, container image scanning, and secret detection.
• Partnering with engineering on our SOC 2 Type II posture - working across evidence collection, control design, and vendor risk.
• Building secure-by-default patterns and libraries so teams don’t have to reinvent security per service.

Core Responsibilities

• Lead and drive Loancrate’s security posture across application security, cloud security, identity, and compliance.
• Perform regular threat modeling, vulnerability assessments, and penetration testing.
• Build and maintain security tooling and automation: SAST/DAST, dependency scanning, container scanning, SBOM management, and secret detection.
• Harden our AWS environment: IAM, VPC boundaries, secrets management, audit logging, GuardDuty, Security Hub, KMS, and WAF.
• Own our SOC 2 Type II program - design practical controls, automate evidence collection, and manage the auditor relationship.
• Lead or coordinate incident response for security events, runbooks, and postmortems.
• Establish and maintain a secure SDLC with lightweight design reviews and developer enablement.
• Maintain a risk register tracking identified threats and remediation status.
• Partner with Operations on endpoint and device security.
• Manage third-party and vendor security risk and due diligence.
• Own identity and access infrastructure: SSO, MFA enforcement, SCIM provisioning, and access reviews.
• Contribute to security documentation, internal runbooks, and team education.

Tech Stack

Our infrastructure runs on AWS and is managed with Terraform and Pulumi Cloud. Application services run in Docker on ECS EC2 or Fargate. Key services include Aurora PostgreSQL, ElastiCache (Redis), MSK (Kafka), and OpenSearch. Our CI/CD runs on Buildkite with TypeScript pipeline-as-code. Observability is powered by Datadog, CloudWatch, and Sentry. DNS and CDN are handled by Cloudflare. Application code is a TypeScript monorepo running Node/Express with a React frontend and GraphQL/Apollo API layer.

Preferred Skills and Background

• Deep application security experience: threat modeling, OWASP Top 10, secure code review, and SAST/DAST tooling.
• Strong AWS security experience across IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.
• Terraform and/or Pulumi proficiency.
• Hands-on SOC 2 experience designing controls, collecting evidence, and managing auditor relationships.
• CI/CD security experience integrating security tooling into developer pipelines.
• Fintech or regulated industry experience.
• Collaborative mindset building relationships with engineering.
• Identity and access experience: SSO/SAML, SCIM, MFA enforcement, and hardware security keys.
• Familiarity with data security for sensitive personal and financial data.
• Strong written communication and documentation skills.
• Scripting and automation chops (Python, Bash, or similar).

Perks & Benefits

• Robust medical coverage (100% of employee + family premiums covered)
• Vision & dental coverage
• 401(k)
• HSA / FSA
• Remote-first culture
• Flexible time off