SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Rain is a global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. As a Visa and Mastercard Principal Member, Rain issues cards that work at 175+ million merchant locations across 220+ countries. The company recently closed a $250M Series C at a $1.95B valuation.
The Security Engineering team ensures Rain is built right by running AI-driven red team assessments, gating pull requests, and setting configuration baselines. This role owns application security for everything outside blockchain: backend services, APIs, cloud infrastructure, and edge systems that move real money for customers.
You will be Rain's application security expert and quality bar for non-blockchain security findings. Your responsibilities include:
- Review red team findings before they reach engineers: reproduce issues, eliminate false positives, assign severity ratings, and write clear tickets for remediation. Continuously improve the scoring system.
- Harden backend services and APIs, particularly money-moving paths. You'll often implement fixes directly.
- Own edge defenses including DDoS protection, rate limiting, WAF rules, and abuse controls.
- Write secure configuration baselines for cloud, code, and SaaS systems, and automate their enforcement.
- Expand the PR security gate to catch more bugs before merge.
- Own attack surface coverage and conduct architecture reviews on new and high-risk systems.
- Evaluate, test, and select security tools—whether to buy, adopt, or build internally.
You'll work closely with Security Operations, providing high-quality findings and clear configuration rules for detection building. The team operates with an open, flat structure where you have freedom to explore ideas and impact the company's roadmap.
REQUIREMENTS:
- 4+ years in application security, product security, or security-minded backend engineering
- Proven track record owning security decisions and influencing senior engineers on design changes while maintaining good working relationships
- Ability to read unfamiliar codebases (TypeScript/Node.js) and identify material bugs; strong judgment distinguishing real findings from false alarms
- Hands-on cloud security experience (ideally GCP), Terraform, and edge defenses (WAFs, rate limiting)
- Experience with threat modeling or architecture reviews; proven ability to run tool evaluations and make build-vs-buy decisions
- Pragmatic mindset: prefer shipping fixes over writing documentation; comfortable using AI tools without blind trust
BONUS:
- Fintech, payments, or card issuing background (PCI DSS experience a plus)
- Pentest, bug bounty, or red team experience
- Experience building security scanners, static analysis rules, or LLM-based review tools
- AI security for agents and agentic payments, or corporate security/IT experience
