Senior Security Engineer

 About the role
 
At Hummingbird, we want to build better software to fight financial crime. Our engineering team is responsible for making that a reality. They dive deep into the problems that make financial crime fighting so difficult and design flexible, scalable solutions that empower our customers to catch the bad guys. Our product sits at the intersection of financial technology, data science, security, policy, law enforcement, and design. As employees at a small startup, software engineers at Hummingbird have the opportunity to wear many hats and learn and grow across a multitude of dimensions. 
 
The Trust team owns the platform that everything else runs on. As a Senior Security Engineer on Trust, you'll be the person driving security across Hummingbird's infrastructure -- protecting a data set that includes some of the most sensitive finaical information imaginable, growing fast. The threat landscape is evolving quickly, especially AI: we're navigating security risks introduced by AI built into our product, the need to govern how our team uses AI tools internally, and increasingly sophisticated AI-powered external attacks. You'll have real ownership of this work, from hands on engineering to shaping our security posture for years to come.
 

What you'll do:

• Drives security engineering across Hummingbird's infrastructure. You'll help lead our security posture: managing vulnerability and dependency tooling, designing and enforcing controls, and ensuring our AWS environment — managed via Terraform — is hardened and audit-ready for the tier 1 financial institutions we serve.
• Work with a small, passionate, and experienced team: We're a small team of mostly senior engineers and we love to do great work together. We're fully remote, but we make a strong effort to prioritize, design, and code collaboratively.
• Grapple with the challenges of working in a high security, high stakes environment: We work with some of the most sensitive data you can imagine and provide a critical service to our customers. You'll help develop a threat intelligence program that monitors the external landscape and connects it to our internal risks, including incident response and disaster recovery.
• Influence the overall architecture and hosting strategy: Great ideas come from everywhere. Everyone on the team has a voice in technical discussions, and is trusted to make significant decisions.
• Have the opportunity to grow into leadership: Hummingbird is growing rapidly. As we do, there will be opportunities for engineers to take on new roles in product, technology, or people leadership positions. 

About you:

• 7+ years of experience, including 3–5 years in a dedicated security engineering role (Security Engineer, AppSec Engineer, or equivalent), preferably with some startup experience.
• You love digging into complex problems and determining both the root cause and the best solution to fix.
• You're happy spelunking logs and running diagnostic tools to make sure you understand the problem.
• You sail through ambiguity and are comfortable across the infrastructure layer — Terraform and AWS are your tools, not mysteries. You can move between network security and encryption, access controls and permissions, and high-level architecture without losing the thread.
• Iteration is part of the fun. You’re not married to specific ideas or solutions.
• You want your impact to go beyond the lines of code you write.
• Safety first. You care about quality, testing, and security.
• You're actively thinking about what AI means for security — not just as a tool to work faster, but as a new threat vector that demands new defenses.
• You want to build something exceptionally valuable and have a real impact on the world. You're excited to get your hands dirty in pursuit of that goal.
• (Bonus) Experience in the financial sector, especially around compliance or fraud.

Technologies we use and teach:

• AWS, Azure, PostgreSQL, Redis
• Terraform, CircleCI, Nix, Docker
• Ruby/Rails, Python
• OpenAI
• React, JavaScript, TypeScript, GraphQL, d3