Security Engineer, Business Continuity & Risk

Bay Area, CA · US - CA - SoCal - Remote · 4+ years experience · Remote · Posted Oct 1, 2026

At a glance

Square Financial Services, Inc. (SFS) is seeking a Security Engineer to own and operationalize a third-party risk management and business continuity program.
The role involves building data pipelines, integrations, and agentic AI workflows to turn manual governance processes into continuous, auditable products.

Own and operationalize a SFS third-party risk management and business continuity program.
Define the technical approach for ambiguous, cross-team problem spaces and frame problems as often as you solve them.
Build and operate pipelines and integrations that aggregate, normalize, and join risk, control, and asset signals from systems of record across Block and SFS.
Translate standards and compliance requirements into policy-as-code with enforceable, testable rules that run continuously.
Design agentic AI workflows pairing LLM reasoning with deterministic, auditable decision layers for evidence analysis, control monitoring, classification, and assessment.
Automate evidence collection and continuous control monitoring to replace point-in-time audit preparation.
Partner with Security, Procurement, Resilience and Engineering teams to find manual processes worth turning into products.
Contribute to technical design discussions, evaluating the security and reliability properties of the platform itself.

Third-party risk management and business continuity experience.
4+ years building production software in backend, platform, data, or software engineering.
Multi-year ownership of a production system, including on-call, SLOs, and maintenance work.
Proficiency with at least one of Python, Kotlin, Java, or Go, and comfort reading unfamiliar codebases.
Hands-on experience building with LLMs (prompting, tool use, agents, or LLM-backed features) and opinions about model judgment.
Experience with integration patterns including REST APIs, webhooks, authentication flows, and event-driven architectures.
Experience pulling, normalizing, and joining data from multiple imperfect sources, and handling edge cases gracefully.
Experience defining technical direction where the problem was ambiguous, and carrying it across team boundaries.

Working knowledge of a security or compliance framework such as PCI DSS, SOX, SOC 2, ISO 27001, or NIST.
Production-scale LLM or agentic systems experience.

Show all 15 skills