Security Engineer - AppSec
Remote · 4+ years experience · Full-time · Remote · Posted Oct 5, 2026
At a glance
- Experience
- 4+ years experience
- Employment
- Full-time
- Workplace
- Remote
- Location
- Remote
About Rain
- Rain is the global stablecoin payments platform for enterprises, neobanks, platforms, developers, and AI agents. Our technology allows partners to move, store, and use stablecoins instantly and compliantly through global payment cards, rewards, on/offramps, wallets, and cross-border rails. As both a Visa and Mastercard Principal Member, Rain issues cards that work at more than 175 million merchant locations in over 220 countries and territories. Built natively for stablecoins and trusted by more than 100 organizations worldwide, Rain delivers secure, scalable infrastructure that makes money move freely and instantly around the world.
- You will have the opportunity to deliver massive impact at a hypergrowth company backed by some of the top investors in fintech, crypto, and SaaS. In January 2026, we closed a $250M Series C led by ICONIQ, valuing Rain at $1.95B, with Sapphire Ventures, Dragonfly, Bessemer Venture Partners, Galaxy Ventures, FirstMark, Lightspeed, Norwest, and Endeavor Catalyst also participating. If you're curious, bold, and excited to help shape a borderless financial future, we'd love to talk.
About the role
- Rain is seeking an application security expert to serve as the quality bar for non-blockchain security findings.
- This role owns the security of backend services, APIs, cloud infrastructure, and edge defenses that facilitate global stablecoin payments.
- The position involves collaborating with engineering teams to harden systems, manage security gates, and define configuration baselines.
Responsibilities
- Review and validate red team findings, including reproducing issues, eliminating false positives, and setting severity levels.
- Harden backend services and APIs, particularly money-moving paths, by writing fixes directly.
- Manage edge defenses including DDoS protection, rate limiting, WAF rules, and abuse controls.
- Develop secure configuration baselines for cloud, code, and SaaS environments and convert them into automated checks.
- Enhance PR security gates to block vulnerabilities before code is merged.
- Conduct architecture reviews on new and high-risk systems to ensure attack surface coverage.
- Evaluate, select, and implement security tools through build, buy, or adopt strategies.
Requirements
- 4+ years of experience in application security, product security, or security-minded backend engineering.
- Proven ability to own security decisions and influence senior engineers regarding design changes.
- Proficiency in reading and identifying bugs in TypeScript/Node.js codebases.
- Hands-on experience with cloud security, specifically GCP.
- Experience with Terraform and edge defense technologies like WAFs and rate limiting.
- Experience conducting threat models or architecture reviews.
- Experience evaluating and selecting security tools.
Preferred qualifications
- Background in fintech, payments, or card issuing (PCI DSS).
- Pentest, bug bounty, or red team experience.
- Experience building security scanners, static analysis rules, or LLM-based review tools.
- Experience with AI security for agents and agentic payments.
- Experience with corporate security alongside IT.
Benefits
- Unlimited time off (10-day minimum required).
- 95% coverage of health, dental, and vision plan costs for employees.
- 90% coverage of health, dental, and vision plan costs for dependents.
- 100% company-subsidized life insurance plan.
- 401(k) with 4% company match.
- Equity option plan.
- Monthly health and wellness stipend.
- In-office lunch and dinner credits.
Workplace
- Remote role.
- Flexible working environment (work from home, office, or both).
- In-office meals provided via DoorDash credit for those working from an office.
Skills
- TypeScript
- Node.js
- GCP
- Terraform
- WAF
- DDoS Protection
- Rate Limiting
- Application Security
- Cloud Security
