Security Engineer

Drivetrain is on a mission to empower businesses to make better decisions. Our financial planning & decision-making platform helps companies scale and achieve their targets predictably.

Drivetrain is a remote-first company headquartered in the San Francisco Bay Area. Founded in 2021 by a couple of ex-Googlers, Drivetrain is a fast-growing company on a trajectory for success with backing from leading venture capital firms.

💜 Remote-friendly: Drivetrain brings together the best and the brightest, no matter where they are and provides them a great degree of autonomy. We trust our people.

🗣️ Open & transparent:  We know that when our creators have access to all the information they need, their best work will emerge.

👏 Idea-friendly:  We provide an environment to explore new ideas, to take risks, to make mistakes, and to learn, so you can succeed. Anyone in the company can come up with great ideas and become a catalyst for positive change. We let the best ideas win.

👥 Customer-centric:  We follow a product-led growth strategy, continuously  learning from our customers and collaborating to build the amazing software that Drivetrain is.

The Role

You will own Drivetrain's security posture across our product, cloud infrastructure and internal systems. Working closely with Engineering, DevOps and Compliance, you will make sure security is built into how we ship, not added after the fact. This is a hands-on role for someone who likes building systems, automating controls and using AI to scale a small security function well beyond its size. High-stakes work: you will protect the data that finance leaders at enterprise companies rely on.

What You'll Do

• Secure our cloud infrastructure (AWS), including IAM, network security, secrets management, logging and monitoring.
• Embed security into the SDLC through threat modeling, secure code reviews, and SAST, DAST and dependency scanning in CI/CD.
• Lead vulnerability management end to end, from discovery and triage to remediation with engineering teams.
• Own detection and incident response: build alerting, write runbooks, and lead investigations when something goes wrong.
• Drive compliance programs such as SOC 2 Type II, ISO 27001 and GDPR, and automate evidence collection wherever possible.
• Answer customer security questionnaires and join security reviews with enterprise prospects alongside the sales team.
• Manage third-party and vendor risk, including reviews of the AI and data vendors we integrate with.
• Assess and secure the use of LLMs in our product, covering prompt injection, data leakage and model access controls.
• Run security awareness for the team and make secure practices the easy default.

What You Bring

• 4 to 7 years of hands-on experience in security engineering, cloud security or application security, ideally at a B2B SaaS company.
• Strong working knowledge of AWS security services and Infrastructure as Code (Terraform or similar).
• Experience securing web applications and APIs, with a solid grasp of the OWASP Top 10.
• Comfort writing code or scripts (Python, Go or similar) to automate security tasks.
• Experience supporting SOC 2 or ISO 27001 audits.
• AI fluency is a must, not a nice-to-have. You use AI tools every day to speed up your work, whether that is triaging alerts, reviewing code, drafting policies or automating compliance evidence, and you can show us how.
• Clear communication, so you can explain risk to engineers, leadership and enterprise customers alike.

Nice to Have

• Experience securing LLM-powered features or AI agent workflows.
• Exposure to fintech or other products that handle sensitive financial data.
• Hands-on experience with tools such as Vanta, Drata, Wiz, Snyk or similar.
• Certifications such as OSCP, AWS Security Specialty, CISSP or CCSP.
• Experience as the first or founding security hire at a startup.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.