Senior Security Engineer

Loancrate was founded to simplify and reduce costs for lenders and borrowers in the home-buying process. Traditional mortgage software, built over two decades ago, is slow, unstable, and inefficient. The average human cost to originate a loan remains over $11,000.

Loancrate builds AI-native tooling to automate mortgage workflows, aiming for fully automated origination with the potential to save lenders over $16B annually in operating expenses. Since 2020, Loancrate’s remote team has enabled customers to power over $85 billion in new home loans.

The company values collaboration, open communication, and fun while tackling the complexities of the home-lending industry.

The Opportunity

Loancrate is seeking a Senior Security Engineer to enhance security without hindering development. You’ll design systems, guardrails, and tooling to catch issues early, ensure secure defaults, and enable engineers to move quickly while maintaining peace of mind. Security is an enabler, not a gatekeeper, especially given the sensitive nature of the data handled.

This is an individual contributor (IC) role with broad scope, covering application security, infrastructure security, compliance, and internal tooling. If you’ve worked in fintech or regulated industries and have faced frustration with security slowing down engineering, this is an opportunity to change that dynamic.

What To Expect

As a Senior Security Engineer, you’ll integrate into the codebase and infrastructure quickly. Within your first month, you’ll contribute to:

• Conducting a comprehensive threat model of the application and infrastructure, identifying high-leverage gaps, and creating a pragmatic remediation roadmap.
• Hardening AWS infrastructure with IAM least-privilege, secrets management, network segmentation, CloudTrail audit coverage, and GuardDuty alerting while maintaining frictionless developer workflows.
• Integrating security tooling into the CI/CD pipeline, including SAST, dependency scanning, container image scanning, and secret detection to catch issues before they ship.
• Partnering with engineering on the SOC 2 Type II posture, focusing on evidence collection, control design, and vendor risk to make compliance a byproduct of good security.
• Building secure-by-default patterns and libraries for authentication, authorization, input validation, and secure logging/redaction to prevent reinventing security per service.

Core Responsibilities

• Lead and drive Loancrate’s security posture across application security, cloud security, identity, and compliance, collaborating closely with engineering and leadership.
• Perform regular threat modeling, vulnerability assessments, and penetration testing, and work directly with engineering to remediate findings quickly.
• Build and maintain security tooling and automation, including SAST/DAST, dependency scanning, container scanning, SBOM management, and secret detection integrated into CI/CD.
• Harden the AWS environment with IAM, VPC boundaries, secrets management (AWS Secrets Manager), audit logging, GuardDuty, Security Hub, KMS key management, and DDoS protection.
• Own the SOC 2 Type II program, designing practical controls, automating evidence collection, managing the auditor relationship, and driving continuous improvement.
• Lead or coordinate incident response for security events, including runbooks, postmortems, and clear communication to customers and leadership.
• Establish and maintain a secure Software Development Lifecycle (SDLC) with lightweight design reviews, threat modeling in planning, and developer enablement (training, documentation, examples) that scales.
• Maintain a risk register to track identified threats, ownership, and remediation status, ensuring nothing falls through the cracks.
• Partner with Operations on endpoint and device security, including laptop hardening, MDM policy, hardware key rollout, and offboarding access revocation.
• Manage third-party and vendor security risk, including due diligence for new integrations and annual reviews of existing vendors.
• Own identity and access infrastructure, such as SSO, MFA enforcement (including hardware key policies), SCIM provisioning, and access reviews.
• Contribute to security documentation, internal runbooks, and team education, ensuring the secure path is the easy path.

Tech Stack

The infrastructure runs on AWS and is managed with Terraform and Pulumi Cloud. Application services run in Docker on ECS EC2 or Fargate. Key services include Aurora PostgreSQL, ElastiCache (Redis), MSK (Kafka), and OpenSearch. CI/CD is managed by Buildkite with TypeScript pipeline-as-code. Observability is powered by Datadog, CloudWatch, and Sentry. DNS and CDN are handled by Cloudflare. The application code is a TypeScript monorepo running Node/Express with a React frontend and GraphQL/Apollo API layer. GitHub is used for source control.

Preferred Skills and Background

While not mandatory, these skills are highly valued:

• Deep application security experience, including threat modeling, OWASP Top 10, secure code review, SAST/DAST tooling, and hands-on collaboration with engineers to fix vulnerabilities.
• Strong AWS security experience across IAM, VPC, GuardDuty, Security Hub, CloudTrail, KMS, Secrets Manager, and WAF.
• Proficiency in Terraform and/or Pulumi, with an understanding of security implications in infrastructure-as-code.
• Hands-on SOC 2 experience, including designing controls, collecting evidence, and managing auditor relationships.
• CI/CD security experience, integrating security tooling into developer pipelines in a way that engineers appreciate.
• Fintech or regulated industry experience, with an understanding of security, compliance, and data privacy in lending or financial services.
• A collaborative mindset, building relationships with engineering rather than operating as an external reviewer or blocker.
• Experience with identity and access management, including SSO/SAML, SCIM, MFA enforcement, hardware security keys, and access review programs.
• Familiarity with data security for sensitive personal and financial data, including encryption at rest and in transit, data classification, and minimization.
• Strong written communication skills, including documenting decisions, writing clear runbooks, and communicating security risks to non-security audiences.
• Scripting and automation skills (Python, Bash, etc.) to build scalable security tools.