Senior DevSecOps Engineer

New York Cityfull timeRemote

Apply on Employer Site

senior

$165k–$230k

H1B: no

Greenboard Senior DevSecOps Engineer at Greenboard responsible for owning and scaling security posture across infrastructure, application, and network layers. Lead compliance programs and vendor security diligence.

Responsibilities

We're looking for a hands-on security engineer to own and scale our security posture as we grow. You'll be the first dedicated security hire on our engineering team, which means you'll have a direct hand in shaping how we think about security — from compliance frameworks and vendor diligence to infrastructure hardening and secure development practices.
This is a high-impact, high-autonomy role. You'll work closely with engineering, product, and business teams to make sure we're building securely, meeting the compliance bar our fintech customers expect, and staying ahead of threats as we expand internationally.
Technical Security
Detect, triage, and drive remediation of vulnerabilities across the stack — infrastructure, application, and network.
Manage third-party penetration tests and coordinate internal response to findings.
Integrate security into the development lifecycle: code review guardrails, SAST/DAST tooling, dependency scanning, and developer security guidance.
Own credential and secrets management, including rotation policies, vault configuration, and access controls.
Manage infrastructure patching and hardening, working with engineering to keep systems current without disrupting delivery.
Security Compliance & Frameworks
Own our SOC 2 compliance program end-to-end, including audit preparation, evidence collection, and remediation tracking.
Maintain and mature our GDPR compliance posture, partnering with legal and product to ensure data protection requirements are met.
Lead our ISO 42001 certification efforts, establishing and maintaining the required AI management system controls.

Qualification

ClearComfort with ambiguity and ownershipExperience with MDM platforms

Required

5–10 years of experience in security engineering, application security, or infrastructure security roles.
Hands-on experience with SOC 2 audits and at least one other compliance framework (GDPR, ISO 27001, PCI-DSS, or similar).
Strong technical foundation — you're comfortable reading code, reviewing AWS infrastructure, and working in a CI/CD environment.
Experience with vulnerability management tooling (e.g., Snyk, Semgrep, Qualys, Burp Suite, or equivalents).
Familiarity with AWS Secrets Manager and IAM best practices.
Experience managing or coordinating third-party pentests.
Clear, low-ego communication style — you can explain a risk to an engineer and a compliance requirement to a salesperson with equal clarity.
Comfort with ambiguity and ownership. This is a build-it role, not a maintain-it role.

Preferred

Prior experience at a fintech or other regulated-industry startup.
Familiarity with ISO 42001 or AI governance frameworks.
Experience with MDM platforms
Background supporting international expansion from a security/compliance perspective.