## **ABOUT KARAT**
Karat started by building corporate cards and banking accounts for creators, the people you follow on YouTube, Instagram, TikTok and Twitch who run real businesses but were treated as an edge case by most financial providers. The same products fit a much wider set of businesses, and today we serve creators alongside the agencies, studios and growing companies that run the same way.
We've raised $70 million from Signal Fire, Union Square Ventures, Y Combinator, CRV and Coatue, alongside CEOs from YouTube, Twitter and Wealthfront and Twitch co-founder Kevin Lin. Our team comes from Goldman Sachs, McKinsey, earlier startups and the creator world itself, and we're headquartered in Los Angeles.
We hold our customers' money and their financial data, and the compliance and security obligations that come with a banking program are ours to own, not someone else's. Securing that well, without slowing down a small team that ships fast, is the job.
## **ABOUT THE ROLE**
We're hiring our first dedicated security engineer. Today, security at Karat is owned by the engineers and operators who happen to be closest to each system. You'll take that over and turn it into a program: the cloud infrastructure and edge that run our banking, charge card, and payments products, the pipeline that ships them, the laptops and SaaS our team works from, and the SOC 2 and bank partner evidence that proves all of it is working.
This is a hands-on engineering role, not an advisory one. You'll write infrastructure as code and application code, deploy and run the systems you build, and review the pull requests that touch auth, money movement, and customer data. You'll also be the person who explains to our bank partners and auditors how our controls work, because you built them.
We're a lean team that ships fast and uses AI tooling heavily. The engineer we want cares as much about not slowing anyone down as about locking things down. If your instinct is to add a control and then measure how much friction it created, you'll fit.
## **WHAT YOU'LL DO**
* Own our cloud security posture: IAM and least privilege, network segmentation, secrets management, WAF and edge rules, logging, backups, and infrastructure as code.
* Secure how we ship: source control access, CI/CD, dependency and secrets scanning, environment separation, and production access that is auditable without being painful.
* Own corporate and endpoint security: identity and SSO, OAuth scope and sharing audits, device management with automated onboarding and offboarding, phishing-resistant MFA with hardware keys and passkeys, and a laptop baseline that's enforced as code with staged rollouts.
* Run the technical side of our SOC 2 program and bank partner due diligence: controls as code, evidence that collects itself, network and data-flow diagrams, pen test coordination, vendor security reviews, and the security questionnaires our partners send.
* Build detection and response: centralize logs, write the alerts that matter for a fintech (account takeover, privileged access, unusual money movement), write the runbooks, and be first call when something looks wrong.
* Partner with product engineers on application security: threat-model new features (payouts, card issuance, KYC flows), review the risky PRs, and ship security features our customers see, like passkeys and session hardening.
* Set the rules for how Karat uses AI agents and tools safely: what they can access, what gets logged, and where customer data can and can't go.
* Keep us current. You'll track what's happening to other fintechs (account takeover rings, support-desk social engineering, supply-chain compromises) and translate it into what we change this quarter.
* Build paved roads, not gates. When engineers or ops teammates route around a control, treat that as a bug in the control.
## **WHAT YOU'LL NEED**
* 5+ years in infrastructure, DevOps, platform, or security engineering, including years spent building and running production systems on a major cloud provider. You've been on call for something that mattered.
* You write code and ship it. Infrastructure as code (Terraform, Pulumi, or similar), plus fluency in at least one of TypeScript, Python, or Go. We'll ask you to show us something you built.
* Hands-on with the corporate side: a productivity suite like Google Workspace or Microsoft 365, an MDM, an identity provider, and hardware security keys. You've rolled these out to real people and dealt with the fallout.
* You've built or materially run the technical side of a SOC 2, PCI, or bank partner audit at a company that didn't have a compliance team to hand it to.
* Founder DNA. You've started something, or you were one of the first 20 people somewhere and owned a function nobody else would. You're comfortable deciding what matters when nobody tells you.
* Finance or fintech experience, and interest in it. You've worked at a bank, a fintech, a payments company, or in another regulated environment, and you understand why a bank partner asks the questions it asks.
* A track record of choosing not to ship a control because the friction wasn't worth the risk reduction. You can tell us about one.
* You follow the field closely. You can talk about the last few incidents at fintechs and what you'd have done differently, and you have opinions about passkeys, device trust, and securing AI agents.
* Clear writing. Auditors, bank partners, and teammates will read what you write, and most of your influence will come through it.
* Based in Los Angeles, or willing to relocate. Open to remote for the right candidate.
## **NICE TO HAVE**
* Edge security depth: WAF, zero trust access, and DNS.
* Detection engineering: you've built alerting from raw logs without a big SIEM budget.
* You've shipped WebAuthn or passkey support in a product.
* You've sat on the company side of a BaaS or sponsor bank audit.
* You've built security controls for LLM tooling or agents: access scoping, logging, data handling.
* Public work: open source, writeups, talks, or a bug bounty profile.
## **WHY KARAT?**
* **Huge opportunity.** Creators, agencies, studios, and the growing companies that run like them are a huge market that most financial providers still treat as an edge case. We've built the products; now we're scaling them. It's our race to lose.
* **Fascinating problems.** We move real money for real businesses: card issuance, payouts, KYC, and the fraud and compliance work that comes with holding deposits. Securing all of that for a lean team that ships daily and runs on AI tooling is a problem few people get to own end to end.
* **You set the defaults.** There's no security org to inherit and no legacy controls to untangle. The patterns you choose in your first year will be some of the first Karat will run on.
* **The right team.** Previous founders, operators from banking and payments, and engineers who've shipped at top companies, all hands-on. Small enough that you'll know everyone's work and everyone will know yours.
* **Culture.** Own your stuff, get stuff done, make stuff better. We hire high-agency people who come in to improve Karat, not maintain it. If you've been waiting for permission somewhere else, you won't need it here.
* **Resources and growth.** We're well capitalized and we keep the team lean, so this is a rare seat. You'll learn a lot, build foundational systems, and grow as the company scales.
Visa sponsorship is not available for this role.
