SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Rain is a global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. As a Visa and Mastercard Principal Member, Rain issues cards that work at 175+ million merchant locations across 220+ countries. The company closed a $250M Series C in January 2026 at a $1.95B valuation, backed by ICONIQ, Sapphire Ventures, Dragonfly, Bessemer Venture Partners, and others.
The Security Engineering team is small and focused on ensuring Rain's systems are built correctly. The team runs an AI-driven red team against Rain's code and cloud infrastructure, gates pull requests before merge, and establishes configuration baselines for all systems. This role owns application security for everything outside blockchain: backend services, APIs, cloud infrastructure, and edge systems that move real money for customers. You will work closely with Security Operations, providing high-quality findings and clear configuration rules for detection building.
As Rain's application security expert, you will be the quality bar for all non-blockchain security findings. You own the technical decisions: determining what findings are real, assessing severity, and deciding what must be fixed before launch. You will hold the line with engineers when necessary and make the case so they agree, not just comply.
Key responsibilities include: reviewing red team findings before they reach engineers (reproducing issues, eliminating false positives, setting severity, writing clear tickets); improving the scoring system that grades findings; hardening backend services and APIs, especially money-moving paths (often writing fixes yourself); owning edge defenses including DDoS protection, rate limiting, WAF rules, and abuse controls; writing secure configuration baselines for cloud, code, and SaaS systems and converting them to automated checks; expanding the PR security gate to block more bugs before merge; owning attack surface coverage and running architecture reviews on new and high-risk systems; and evaluating, testing, and selecting security tools (buy, adopt, or build).
The company offers unlimited time off (with a 10-day minimum), flexible working arrangements, home workspace stipends, comprehensive health/dental/vision coverage (95% for employees, 90% for dependents), company-subsidized life insurance, 401(k) with 4% match, equity options for all employees, monthly health and wellness stipends, in-office meals via DoorDash credits, and domestic and international team summits.
REQUIREMENTS:
- 4+ years in application security, product security, or security-minded backend engineering
- Demonstrated ownership of security decisions; ability to advise senior engineers on design changes while maintaining good working relationships
- Ability to read unfamiliar codebases (TypeScript/Node.js) and identify material bugs; ability to distinguish credible findings from false alarms
- Hands-on cloud security experience (ideally GCP), Terraform, and edge defenses (WAFs, rate limiting)
- Experience with threat modeling or architecture reviews
- Experience running tool evaluations and making build-vs-buy decisions
- Preference for shipping solutions over writing documentation; comfortable using AI tools without blind trust
BONUS:
- Fintech, payments, or card issuing background (PCI DSS experience a plus)
- Pentest, bug bounty, or red team experience
- Experience building security scanners, static analysis rules, or LLM-based review tools
- AI security expertise for agents and agentic payments, or corporate security alongside IT
