Security Engineer

Onramp is building a financial platform for Bitcoin, dollars, and stablecoins secured through multi-institution custody. The Security Engineer will own and advance the security roadmap, lead incident response, build AI-driven offensive testing, strengthen cloud and developer security, and contribute product code across the company’s services.

Responsibilities:

• Advance our controls across identity, endpoint, network, email, and browser layers, and handle the change management that gets a small team to adopt them
• Lead incident response: triage, run the response, coordinate with custody partners when needed, and turn every event into a stronger playbook
• Build AI-driven offensive testing: continuous, agent-assisted pen testing and attack simulation that complements our manual program and feeds findings straight to engineering
• Harden the developer pipeline and cloud posture across GitHub, GCP, and Vercel: supply chain scanning, secrets management, IAM least-privilege, required checks on auth, withdrawal, and KYC paths
• Extend custody-specific monitoring and runbooks: fee wallet controls, signing and quorum alerting, address verification
• Refine the verification SOPs sales and ops use against deepfakes, synthetic identity, impersonation, and coerced withdrawals, and train the team on them
• Run access reviews, service account inventory, vendor risk reviews, and SOC 2 evidence as part of the work rather than after it
• Govern our AI-native toolchain with a lightweight pre-adoption review for new connectors and agents
• Ship product code in our TypeScript/Next.js and Elixir/Phoenix services

Requirements:

• 4+ years hands-on security engineering, ideally at an early- or growth-stage fintech, custody, or exchange, where you owned the controls, not just the findings
• You've run incident response end to end and written the post-incident review
• Offensive-minded, with pen testing experience and real interest in making it continuous with AI agents
• A working software engineer on at least one side of a modern stack (React/Next.js and TypeScript, or Elixir/Phoenix, Node, or comparable)
• Deep on identity, endpoint, and cloud security in a Google Workspace, GitHub, GCP, and Vercel environment, and opinionated about right-sizing tooling for a small team
• Fluent in today's threats: AI-driven supply chain attacks, session theft, OAuth phishing, deepfake social engineering
• SOC 2 in practice: you know what an auditor asks for and build evidence into the workflow
• Insanely AI-native, with strong views on securing agents without adding friction
• A clear writer of runbooks, threat models, and async updates people actually read
• Calm in an incident, direct in a review, comfortable with early-stage ambiguity and pace
• You don't need Bitcoin protocol experience to apply. You do need to be curious about it and willing to go deep on custody fast
• Bitcoin custody experience (multisig, PSBT, key-agent architectures), Elixir/Phoenix, agentic security tooling, GCP Security Command Center or Wiz, Terraform, OSCP or equivalent, CTFs or public disclosures