Staff Security Engineer

About Us

Rho is the modern banking platform built for the AI era. Startups and growth-stage companies can open accounts in minutes, issue cards, manage expenses, pay bills, and close the books – all in one connected platform backed by real human support.

About Us

Rho is on a mission to make finance frictionless for organizations. Our team and technology power high-performing companies with an all-in-one, end-to-end finance platform that lets organizations safely manage cash and spending across commercial-grade banking, corporate cards, treasury management, expense management, accounts payable, and more.
Our customers run their banking, cards, and payments through Rho. We are splitting a large Python monolith into Go and Python services on GCP, and shipping a public API, agents, and MCP surfaces. Security is part of the product.
The Team

Security at Rho is small: a VCISO, one security engineer in Poland, and the engineers who ship. You will be the first US security engineer. We plan to grow this into a team over the next six months, and you will help pick who.
The Role

Hands-on. You write production code most days. You own product and platform security, and you own finding queues and incident response until we hire for detection and response.

What you'll do
Product Security

• Threat model new systems and review designs with the teams that own them before they ship.

• Build the paved road: secure defaults, guardrails in CI, dependency and supply chain checks, so the safe way is the easy way.

• Own the vulnerability lifecycle: triage findings from Pensar, Semgrep, CodeQL, Dependabot, pentests, and inbound researcher reports; hold the SLAs; write the fix or get it written; track remediation to zero. Stand up our vulnerability disclosure program.

Platform Security

• Harden GCP and GKE: least-privilege IAM, workload identity, secrets, network policy, environment separation, all in Terraform.

• Secure our LLM, agent, and MCP surfaces: guardrails, sandboxes, agents as identities with scoped access, prompt injection detection.
  

Detection & Response

• Own detections in our SIEM, tune signal to noise, keep the runbooks current, stand up on the call rotation, and lead incidents end to end: triage, contain, investigate, remediate, post-mortem.

• Run tabletop exercises and hunt for what detections miss.

What we're looking for

• 6+ years in security engineering, or software engineering with a security focus. You ship code and tools, not only findings.

• Depth in one of product security, cloud and platform security, or detection and response, and working knowledge of the other two.

• Comfortable changing production and owning the outcome. Python or Go, Kubernetes, Terraform, one major cloud.

• You can triage competing risks and trade security against velocity without slowing the team down.

• Clear writer: design reviews, runbooks and incident reports engineers actually read.

NICE TO HAVE

• Fintech, payments or another regulated industry. PCI DSS or SOC 2 evidence work.

• Bug bounty, red team, CVEs, talks, or open source.

• Hands-on AI security: guardrails, agent identities, prompt injection.