SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 190,000 - 295,000 / annual
Cardless is building infrastructure for companies to design, build, and launch their own branded financial products. The company powers credit card issuance for brands like Coinbase and Bilt, handling lending, compliance, and operations while remaining invisible to end users. Recently raised $60M Series C (total $170M funding), with 70+ team members and a path to profitability by end of 2026.
As a Risk Engineer, you will own the systems that decide whether to trust a person, device, or transaction. Currently, much fraud decisioning runs through vendor platforms; you'll build an in-house layer that moves fraud logic into a testable control plane with versioned code, kill switches, and real-time visibility for analysts.
Key responsibilities:
- Build the risk decisioning layer for card authorization and mobile wallet provisioning (approvals, step-ups, freezes)
- Migrate fraud logic from vendor dashboards into a unified control plane with shadow mode, staged rollout, and kill switches
- Develop real-time detection and alerting for velocity, cross-provisioning, and device signals; implement lockdown posture for active attacks
- Gate servicing changes (address, phone, email, reship) on risk evaluation and ship tooling for fraud analysts
This is a senior-to-staff role with real architectural ownership, working directly with Risk and Fraud Operations teams. You'll be the founding risk engineer, deciding what the platform is, what belongs in code versus vendor config, and defining what "defended" means across every brand Cardless launches.
The role is 5 days per week in-office in San Francisco (Jackson Square district).
REQUIREMENTS:
- 6+ years building production backend systems with meaningful time in fraud, payments risk, or trust and safety engineering
- Proven experience building risk systems as an engineer: decisioning services, rules engines, real-time scoring, step-up orchestration (not analyzing fraud or handing models off for deployment)
- Strong distributed systems and API fundamentals in a modern backend language (Java primary, Python for data work)
- Mindset around blast radius: understanding failure modes, kill-switch design, and incident response
BONUS:
- Card issuing experience: auth-time decisioning, tokenization, wallet provisioning, disputes, PCI
- Account takeover and step-up auth: OTP, SIM swap, phishing resistance, device fingerprinting, passkeys, IDV
- Prior experience at risk or identity vendors (Sardine, Sift, Unit21, Feedzai, Alloy, Persona)
