Founding Security Engineer

ABOUT KARAT

Karat started by building corporate cards and banking accounts for creators, the people you follow on YouTube, Instagram, TikTok and Twitch who run real businesses but were treated as an edge case by most financial providers. The same products fit a much wider set of businesses, and today we serve creators alongside the agencies, studios and growing companies that run the same way.

We've raised $70 million from Signal Fire, Union Square Ventures, Y Combinator, CRV and Coatue, alongside CEOs from YouTube, Twitter and Wealthfront and Twitch co-founder Kevin Lin. Our team comes from Goldman Sachs, McKinsey, earlier startups and the creator world itself, and we're headquartered in Los Angeles.

We hold our customers' money and their financial data, and the compliance and security obligations that come with a banking program are ours to own, not someone else's. Securing that well, without slowing down a small team that ships fast, is the job.

ABOUT THE ROLE

We're hiring our first dedicated security engineer. Today, security at Karat is owned by the engineers and operators who happen to be closest to each system. You'll take that over and turn it into a program: the cloud infrastructure and edge that run our banking, charge card, and payments products, the pipeline that ships them, the laptops and SaaS our team works from, and the SOC 2 and bank partner evidence that proves all of it is working.

This is a hands-on engineering role, not an advisory one. You'll write infrastructure as code and application code, deploy and run the systems you build, and review the pull requests that touch auth, money movement, and customer data. You'll also be the person who explains to our bank partners and auditors how our controls work, because you built them.

We're a lean team that ships fast and uses AI tooling heavily. The engineer we want cares as much about not slowing anyone down as about locking things down. If your instinct is to add a control and then measure how much friction it created, you'll fit.

WHAT YOU'LL DO

Own our cloud security posture: IAM and least privilege, network segmentation, secrets management, WAF and edge rules, logging, backups, and infrastructure as code. Secure how we ship: source control access, CI/CD, dependency and secrets scanning, environment separation, and production access that is auditable without being painful. Own corporate and endpoint security: identity and SSO, OAuth scope and sharing audits, device management with automated onboarding and offboarding, phishing-resistant MFA with hardware keys and passkeys, and a laptop baseline that's enforced as code with staged rollouts. Run the technical side of our SOC 2 program and bank partner due diligence: controls as code, evidence that collects itself, network and data-flow diagrams, pen test coordination, vendor security reviews, and the security questionnaires our partners send. Build detection and response: centralize logs, write the alerts that matter for a fintech (account takeover, privileged access, unusual money movement), write the runbooks, and be first call when something looks wrong. Partner with product engineers on application security: threat-model new features (payouts, card issuance, KYC flows), review the risky PRs, and ship security features our customers see, like passkeys and session hardening. Set the rules for how Karat uses AI agents and tools safely: what they can access, what gets logged, and where customer data can and can't go. Keep us current. You'll track what's happening to other fintechs (account takeover rings, support-desk social engineering, supply-chain compromises) and translate it into what we change this quarter. Build paved roads, not gates. When engineers or ops teammates route around a control, treat that as a bug in the control.

WHAT YOU'LL NEED

5+ years in infrastructure, DevOps, platform, or security engineering, inclu