Senior Security Engineer, Application Security
Kikoff
$268,000 - $321,000 / year
Need a reasonable accommodation to apply or interview? Contact us.
JobMinglr uses automated technology to recommend jobs based on profile information and job preferences. Match Score does not determine eligibility for a position, prevent a user from viewing or applying to a job, or make hiring decisions on behalf of an employer.
Description
Kikoff: The Fintech Powering Financial Security at Scale
Kikoff is a profitable, pre-IPO fintech company on a mission to empower everyone to achieve financial security. With record revenue growth in 2025 and a unicorn valuation, we've built a suite of products that help millions of people build credit, access liquidity, and save money.
We're scaling fast. Join us if you want to build something meaningful and help millions of people move forward financially.
Why Kikoff:
This is a consumer fintech startup, and you will be working with serial entrepreneurs who have built strong consumer brands and innovative products. We value extreme ownership, clear communication, a strong sense of craftsmanship, and the desire to create lasting work and work relationships. Yes, you can build an exciting business AND have real-life real-customer impact.
About the Role
Kikoff exists to help millions of people build credit. That only works if the products they use are safe. This role helps shape the Application Security pillar at Kikoff: how code gets written, reviewed, shipped, and defended across our web, mobile, and API surfaces.
You will drive and help shape the application security roadmap. You define the strategy, sequence the work, and drive it to done. Engineers ship fast here, and increasingly with AI agents writing code alongside them. Your job is to make that speed safe by default.
In This Role, You Will
Drive the Pillar
- Drive the application security roadmap: secure SDLC, code review, threat modeling, vulnerability management, and the pentest and bug bounty programs.
- Set the standard for what secure code looks like at Kikoff and build the tooling that enforces it: SAST, SCA, secrets scanning, and dependency policy wired into CI with signal engineers trust.
- Decide how AI-generated code gets reviewed and gated. Design the controls for a codebase where agents are contributors.
Build & Secure
- Build paved roads into the frameworks engineers use: authn/authz libraries, input validation, safe defaults for common patterns, so the secure way is the only way most engineers encounter.
- Own security for our authentication and session layer: MFA design, account recovery, session management, and defenses against credential stuffing and account takeover.
- Secure our APIs and mobile apps: authorization models, rate limiting, abuse controls, certificate pinning, and secure storage on device.
- Secure the AI features we ship to customers: prompt injection defenses, tool permission boundaries, and data exposure controls for LLM-backed flows.
Prove It
- Run the penetration testing and bug bounty programs. Triage, drive remediation, and close the loop with engineering.
- Build vulnerability management that holds up in front of auditors: defined SLAs, tracked remediation, and evidence that stands on its own for PCI-DSS, SOC 2, and IPO-readiness controls.
- Threat model new products and major features before they ship, not after.
Enable Engineering
- Be the security engineer product engineers actually want in their design reviews. Clear answers, fast turnaround, real fixes.
- Stand up and run a security champions program so AppSec scales past one person.
- Build internal tooling, including AI-assisted review and triage, that multiplies the team's reach.
Qualifications
- 6+ years in security engineering with deep, hands-on application security experience: secure code review, threat modeling, vulnerability triage, and remediation at scale
- You write production code. Fluency in at least one of Ruby, Python, Go, or TypeScript, and comfort reading all of them
- You have designed and shipped authentication and authorization systems, not just reviewed them. OAuth/OIDC, session management, MFA, account recovery
- Hands-on with modern AppSec tooling and the judgment to know when it is wrong: SAST, SCA, DAST, secrets scanning, CI/CD integration
- Experience securing REST/GraphQL APIs and native mobile applications
- You have run or built a pentest or bug bounty program
- Comfortable in a fintech regulated environment: PCI-DSS, SOC 2, or similar
Bonus Points
- Securing LLM-backed product features or agentic workloads in production
- Fraud and abuse defense: bot detection, credential stuffing mitigation, device signals
- Security champions or developer education programs you started, not inherited
- Supply chain security depth: dependency provenance, artifact signing, build integrity
- Consumer fintech or financial services background
A note on applying: We know great candidates sometimes hold back if they don’t meet every qualification listed. If you’re excited about this role and believe you can do the work, we encourage you to apply. We’re looking for capability and trajectory, not a perfect checklist match.
Equal Employment Opportunity Statement
Kikoff Inc. is an equal opportunity employer. We are committed to complying with all federal, state, and local laws providing equal employment opportunities and considers qualified applicants without regard to race, color, religion, creed, gender, national origin, age, disability, veteran status, marital status, pregnancy, sex, gender expression or identity, sexual orientation, citizenship, or any other legally protected class.
Please reference the following for more information.
About this role
Kikoff is building application security infrastructure for a fintech company scaling fast with AI-assisted development. This role owns the full application security pillar—from secure coding practices and tooling through authentication systems, API and mobile security, to penetration testing and vulnerability management. You'll shape how code gets written, reviewed, and shipped safely across web, mobile, and API surfaces, while managing the specific challenge of securing AI-generated code alongside human engineers.
The work spans both strategy and hands-on execution. You'll design and enforce secure defaults through frameworks and libraries, run the pentest and bug bounty programs, build vulnerability management processes that satisfy auditors, and threat model new products before launch. You'll also scale yourself by standing up a security champions program and building internal tooling. This requires someone who writes production code fluently, has shipped authentication and authorization systems in the real world, and knows modern AppSec tools well enough to judge when they're wrong.
The ideal candidate brings six-plus years of application security depth—code review, threat modeling, vulnerability triage at scale—plus hands-on experience with REST/GraphQL APIs, native mobile apps, and fintech compliance (PCI-DSS, SOC 2). Experience securing LLM features, fraud defense, or supply chain security is a plus. The role is full-time, in-office in San Francisco, with a base salary of $268,000–$321,000.
How this employer is doing
average
- H1B: Sponsors Visas
- Sponsors Visas
This role's local market on JobMinglr
Pay for this role
$268,000 to $321,000 per year
That is the employer's posted range, and where you land in it is usually decided in one conversation. Before that conversation, run the numbers: analyze an offer for this role.
Before you apply, worth reading
How JobMinglr reads this job
Every listing here is scored against your profile before you apply: skills overlap, experience level, location and work arrangement, each weighted and explained. You see the score and the reasons, not just a list. How the matching works.