Staff Security Engineer

About Cari

The Cari Network is building a blockchain-based payment system powering real-time, 24/7 movement of digital money across the traditional finance and digital asset ecosystems. A pre-launch startup, we’re creating an entirely new category of financial infrastructure that brings cash on chain through tokenization while powering the full spectrum of payments for our network — banks and most importantly, the customers they serve.
About the Role

Youll be a foundational security hire reporting directly to the CISO, building our security program from the ground up with high autonomy on a small team. Our platform processes tokenized bank deposits, turning payment instructions into immutable on-chain records. Youll secure every step of that path: identity, cloud, and detection, through our institutional custody integration, all the way to on-chain finality on our private ZKsync-based L2.
What Youll Do

Own identity end to end.

Roll out SSO and automated joiner-mover-leaver lifecycle management across corporate and production systems. Design the role and entitlement model, run periodic access reviews, and make least privilege the default.

Secure blockchain and signing infrastructure.

Partner with engineering to threat-model and harden our Solidity smart contracts, private ZKsync L2 nodes, and custody platform integrations. Define upgrade governance for on-chain systems.

Build detection from the ground up.

Deploy and own our SIEM, onboarding and normalizing logs across cloud, identity, endpoint, and application layers. Build high-signal detections for authentication abuse, control plane activity, privilege escalation, data movement, and anomalous transactions. You own alert quality, not alert volume.

Lead incident response.

Serve as technical lead for alerting, vulnerability management, and threat response. Write containment runbooks, drive investigations through postmortem, and feed lessons back into detection.

Harden AWS.

Enforce least-privilege IAM, network segmentation, and secrets management across ECS/EKS, MSK, and RDS.

Make security part of shipping.

Build automated security gates into CD pipelines and developer workflows, so security keeps pace with delivery.

Drive compliance readiness.

Work with the CISO to implement and document controls for bank-level governance, third-party risk, and audits such as SOC 2 Type II.

Qualifications

8+ years in information security, DevSecOps, or infrastructure security.

Deep ownership of at least two of these areas, with hands-on experience in the third:
Enterprise IAM:

SSO, federation, automated provisioning and deprovisioning, role and entitlement design, and access reviews.

SIEM and detection:

deployment, tuning, log onboarding, and detection authoring. You can point to detections youve written and explain how you kept them useful.

AWS security:

ECS or EKS, MSK, RDS, IAM, VPC, and Secrets Manager.

Experience securing EVM-compatible blockchain or Web3 infrastructure.

Experience securing CD pipelines (GitHub Actions or equivalent) and containerized workloads.

Incident response leadership.

Comfort working with high autonomy on a small team building a security program from scratch.

Nice to Haves

Solidity smart contract reviews, including upgradeable proxies (such as UUPS) and role governance.

Defensive knowledge of L2s, cross-chain bridges, ZK rollups, and EVM transaction mechanics (ABI encoding, calldata validation, nonce management, event log integrity).

Key management, custody APIs (Fireblocks, Turnkey, Fordefi), MPC signing, or real-time Web3 threat detection and transaction circuit breakers.

Detection-as-code: version-controlled, tested detections mapped to a framework.

Terraform, including auditing environments and codifying secure baselines.

U.S. banking regulation (FFIEC), or SOC 2 Type II and ISO 27001 audits.

What We Offer

Competitive base salary, bonus, and equity

Full medical, vision, dental benefits

401(k) with company matching

Flexible PTO in a remote-first environment

Opportunity to shape a market-defining protocol with an experienced founding team

Security Responsibilities

Applies to all Cari employees
Comply with all Cari information security policies, including the Acceptable Use Policy, and complete required security awareness training.

Protect the confidentiality, integrity, and availability of Cari systems and data, including bank-partner and customer information, consistent with least-privilege access principles.