TrueBiz is a YC-backed merchant risk intelligence platform helping financial institutions understand whether the businesses they serve are legitimate.
We’re at a rare stage as a company: we already work with some of the largest companies in payments and financial services, but we’re still a small team where exceptional people can have an enormous impact on what gets built and how the company develops.
We’ve intentionally stayed lean, moved quickly, and given people much more ownership than they would typically have at a company with our level of enterprise traction. There are very few layers between identifying an important problem and actually solving it.
The mission matters too. Our technology helps stop fraudulent and abusive businesses from gaining access to the financial system, while helping legitimate businesses get approved faster and with less friction.
## The Role
You will own the reliability of TrueBiz's production platform. That means the AWS infrastructure, the release path, the alerting, and the response when something breaks. It is the first dedicated infrastructure role here. Today a lot of this work is done by the Director of Engineering alongside other duties, and you will take it over and make it yours.
Reliability is the primary job. You will also run the technical side of our established security and SOC 2 program day to day, working alongside a dedicated compliance platform and outside security advisors who handle policy, audits, and architecture review. Your part is the hands-on operation of the controls and the evidence behind them.
## What you will do
### Reliability (most of your time)
* Carry the pager for production, lead incident response, and write the postmortems that keep an incident from repeating.
* Own alerting and observability end to end: alarms, dashboards, log pipelines, and regular proof that alerts actually reach a human.
* Size the platform against measured traffic. Our load arrives in bursts of thousands of reviews in a few minutes, and you will own the autoscaling floors, queue depths, and load tests that keep those bursts uneventful.
* Define service level objectives with engineering and report against them.
* Run backup and disaster recovery: tested database restores, documented recovery targets, and a periodic recovery drill.
### Infrastructure and releases
* Manage all infrastructure as code in AWS CDK (Python). Nothing in production is changed by hand.
* Own the release path from merge to production: the CI/CD pipeline, deployment PRs, post-deploy verification, and rollback.
* Plan and execute migrations and decommissions, including database schema changes on large tables, engine upgrades, and retiring old systems completely.
* Operate the data layer: Aurora PostgreSQL, read replicas, and Redis.
* Keep staging a trustworthy rehearsal for production.
* Manage AWS and vendor cost, including reserved capacity and cost per review.
### Vendor reliability
* Monitor the error rates, latency, and quota use of the third-party APIs our reviews depend on, and tell apart a vendor outage, a rate limit, and an exhausted plan.
* Work with application engineers on the client behavior that protects us when a vendor degrades: timeouts, backoff, circuit breakers, and budgets.
* Advise on plan sizing and renewals with real usage data.
### Security operations (secondary)
* Triage findings from GuardDuty, Inspector, and dependency scanners, and remediate vulnerabilities on a severity-based schedule.
* Run identity and access: single sign-on, least-privilege roles, access reviews, onboarding and offboarding, and credential hygiene.
* Own secrets and encryption keys: inventory, rotation, and audit logging.
* Maintain the network edge, including rate limiting and web application firewall rules.
* Work with our outside security advisor on architecture review and the annual penetration test, and close the findings.
### Compliance (secondary)
* Operate the technical controls behind our SOC 2 program and produce the evidence for them, most of which comes from systems you already run.
* Supply the technical facts for customer security questionnaires and audit findings, and carry out the remediation.
* Keep runbooks, architecture documentation, and change records current enough that someone else could cover for you.
## What we are looking for
### Required
* Five or more years running production systems, including time on call for a customer-facing service where you were the one who got paged.
* Deep, hands-on AWS experience: ECS on Fargate or a comparable container platform, load balancing, VPC networking and security groups, IAM, RDS or Aurora, CloudWatch.
* Infrastructure as code as your default way of working. CDK is ideal. Strong Terraform or CloudFormation experience with a willingness to switch is fine.
* Comfortable reading and writing Python. Our infrastructure code, tooling, and application are all Python.
* A track record of leading incidents and writing honest postmortems.
* Experience owning a CI/CD pipeline and a release process with safe rollback.
* Working security fluency: IAM policy, KMS, CloudTrail, and vulnerability triage. You do not need to be a security specialist.
* Clear written communication. You will write for engineers, for leadership, and occasionally for a customer's security team.
* Judgment about risk. You verify before you delete, and you can explain why a change is safe.
### Nice to have
* You have been through a SOC 2 audit as the person supplying evidence.
* PostgreSQL operations at scale: upgrades, replication, query tuning, online schema changes.
* Django and Celery, or another task-queue-heavy application.
* Experience with web scraping or headless-browser workloads.
* Experience managing dependence on rate-limited third-party APIs.
* GitHub Actions with OIDC-based deployment to AWS.
* You have been the first infrastructure hire somewhere before.
## Our stack
* **Cloud:** AWS. ECS on Fargate, Application Load Balancer, CloudFront, Aurora PostgreSQL, ElastiCache for Redis, Lambda, EventBridge, SNS, Secrets Manager, KMS.
* **Infrastructure as code:** AWS CDK in Python, with unit tests and type checking on the infrastructure code itself.
* **Application:** Python, Django, Celery workers, and a Scrapy-based crawling fleet.
* **Delivery:** GitHub Actions deploying through short-lived OIDC roles. Separate AWS accounts for staging and production.
* **Observability:** CloudWatch metrics and Logs Insights, Better Stack, Sentry, structured JSON logging.
* **Security tooling:** GuardDuty with runtime monitoring, Inspector, CloudTrail, alerts routed to Slack.
## What success looks like
* **First 30 days:** You are deploying to production on your own, you are in the on-call rotation, and you have read every alarm and know which ones you trust.
* **First 90 days:** Service level objectives exist and are reported. Every production alert has an owner and a runbook. A database restore has been tested and timed. Vulnerability remediation runs on a written schedule.
* **First six months:** The next SOC 2 evidence cycle runs largely from automation. Traffic bursts and vendor degradations are handled by the system, not by a person watching a dashboard. A second person can cover on-call from your documentation.
Visa sponsorship is not available for this role.
