Want to know if this job is worth applying to?
San Francisco, California, United States
Onsite
Imprint helps the world's best brands grow the lifetime value of their customers. We started with co-branded credit cards and rebuilt them to be smarter, more rewarding, and brand-first. We partner with companies like Crate & Barrel, Rakuten, Booking.com, H-E-B, Fetch, and Shell to launch modern credit programs that deepen loyalty, unlock savings, and drive growth. But the card is just the beginning. We combine advanced payments infrastructure, intelligent underwriting, and deep customer data to create delightful and personalized experiences for members as well as efficient and profitable relationships for our brand partners. Our robust technology and world-class operations allow us and our brand partners to offer powerful financial products without becoming a bank.
In the U.S., co-branded cards alone account for over $300 billion in annual spend, and most still run on decades-old legacy bank systems. Imprint is the modern alternative: flexible, embeddable, and built for how people actually pay today. Backed by Kleiner Perkins, Thrive Capital, Ribbit, and Khosla Ventures, we're building a world-class team to redefine how people pay and how brands grow. If you want to move fast, solve hard problems, and own real outcomes, we want to meet you.
As Imprint's Staff Engineer, Security, you'll own the security engineering foundation end to end — AI security governance, application security, cloud infrastructure, detection and response, and identity management. You'll report to the Director of Engineering for Trust & Security and operate as the technical lead defining how security is built at Imprint, using AI leverage from day one to scale impact well beyond headcount.
Imprint is deliberately small and talent dense. We use AI and tooling to give every person outsized leverage. This is a role where you stay hands on, you set the strategic direction and do the work. Whether that balance shifts over time depends on what the business needs and what you want to build.
We power co-branded credit card programs for 10+ enterprise partners, with AI embedded across the business: underwriting, servicing, and how we build software. That AI leverage is core to how Imprint operates, and it creates a security challenge worth solving: how do you build an AI-forward security posture for an organization that moves this fast?
Stay Hands On: Write detection rules, review PRs, file hardening commits, and threat model features alongside engineering teams. This isn't a role where you draw architecture diagrams and hand them off. You set the direction and ship the work yourself.
AI-Native Security: Build security capabilities using AI agents for detection triage, compliance automation, and dependency management. You'll secure AI products and use AI to multiply your own leverage. This is how one engineer operates at the standards of a company 10x this size.
Full Stack Ownership: Own the entire security domain: application security, cloud infrastructure, detection engineering, and AI governance.
Preventative, Not Reactive: Build security that scales with the business rather than firefighting inherited problems. Do it right from the start, before bad patterns harden.
Series D Sweet Spot: We have product-market fit and real traction, but we're still small enough for you to shape everything. Your decisions will drive our security posture for years to come.
High Trust Domain: Co-branded credit cards in regulated fintech (PCI, SOC 2, ISO). Security isn't a tax here; it's what enables every partner launch and every customer interaction.
AI security: Threat-model Imprint's agent surfaces for prompt injection, tool misuse, and authorization boundaries.
AI for security: Build AI-native capabilities that scale your impact: AI-powered detection triage, automated compliance evidence collection, and threat modeling assistance.
Application security: Threat modeling for new features, secure code review, SAST/SCA/DAST in CI, SDL design, dependency management, and secrets management. You read Go and TypeScript well enough to review PRs and catch the bugs that external audits should not have to find.
Cloud and infrastructure security: IAM partitioning across multiple AWS accounts, least-privilege access, JIT elevation, cross-account trust hardening, KMS boundaries, SCP design, Kubernetes pod security, egress filtering, and Terraform security review.
Detection and response: Build the SIEM/SOAR pipeline from log sources through triage, write correlation rules, enable AI-powered triage, stand up on call rotation, and create incident response runbooks.
Identity and access: Drive SSO coverage, access reviews, and JIT elevation in partnership with IT.
Compliance partnership: Design and implement the controls that satisfy SOC 2, PCI, and ISO evidence requirements. GRC runs the audit cycle. You own the underlying controls and make sure they actually hold up, not just pass sampling.
Partner and customer trust: Lead technical responses to third party questionnaires and partner security reviews alongside GRC.
8+ years in security engineering, with experience building a security function from early stages
Someone who builds and ships controls, not just identifies problems for others to fix
Reads and reviews code in production languages (Go, TypeScript, Python, or similar)
Detection engineering experience: has built a SIEM or SOAR pipeline from log sources through triage at least once
Deep AWS security knowledge: IAM policy design, multi account strategies, and how cloud privilege escalation works
Has operated inside PCI DSS scope and shipped controls that survived a real audit
Good judgment on scope: knows when to fix something directly versus set an SLA and hand it to the responsible team
Comfortable using AI tools to scale your own output while working within existing architecture and review processes
Experience as the first or early security hire at a high-growth fintech or marketplace
Background at companies like Ramp, Mercury, Stripe, Whatnot, or similar fast scaling environments
Experience securing AI and ML systems, model pipelines, or AI-assisted development workflows
Familiarity with card issuing, payment processing, or financial services infrastructure
Terraform and Helm fluency with hands-on CI/CD security integration experience
Open source contributions, security research, or conference speaking
If you've built something real in security and want to do it again, we want to talk.
Competitive compensation and equity packages
Leading configured work computers of your choice
Flexible paid time off
Fully covered, high-quality healthcare, including fully covered dependent coverage
Additional health coverage includes access to One Medical and the option to enroll in an FSA
20 weeks of paid parental leave for the primary caregiver and 8 weeks for all new parents
Access to industry-leading technology across all of our business units, stemming from our philosophy that we should invest in resources for our team that foster innovation, optimization, and productivity
Imprint is committed to a diverse and inclusive workplace. Imprint is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. Imprint welcomes talented individuals from all backgrounds who want to build the future of payments and rewards. If you are passionate about FinTech and eager to grow, let’s move the world forward, together.
