Become Rain's application security expert, ensuring the integrity of backend services and APIs in a fully remote environment.
Posted by employer 4 hours ago
First seen on Joblaze 4 hours ago
Last verified on the company career page 4 hours ago
Skills & Technologies
What you'll build
- Review red team findings
- Harden backend services and APIs
- Own edge defenses
- Write secure configuration baselines
- Run architecture reviews
Must have
- 4+ years in application security
- Hands-on cloud security experience
- Experience with threat models or architecture reviews
- Ability to read an unfamiliar codebase
Nice to have
- Fintech, payments, or card issuing background
- Pentest, bug bounty, or red team experience
- Experience building security scanners
- AI security for agents
AI in the day-to-day
We run our own AI-driven red team against Rain's code and cloud.
Requirements
- Experience
- 4+ years
Not disclosed in this posting: compensation, visa sponsorship.
Benefits
Joblaze summary
In the role of Security Engineer focused on application security at Rain, the individual will assess and enhance the security of backend services and APIs, ensuring that vulnerabilities are identified and addressed before deployment. Key skills include expertise in application security, hands-on experience with cloud environments like GCP, and familiarity with tools for threat modeling and architecture reviews. This position is ideal for someone with over four years of relevant experience who can effectively communicate security needs to engineering teams while maintaining collaborative relationships.
Joblaze insights
Quick facts
- Is the Security Engineer - AppSec role remote?
- Yes — Rain lists this as a fully remote position.
- How much experience is required?
- At least 4 years of relevant experience for this Security Engineer - AppSec role.
- What's the tech stack?
- Joblaze extracted these technologies from the posting: GCP, Node.js, Terraform, TypeScript, WAF.
- What seniority level is this role?
- Rain targets senior candidates for this position.
- Is this full-time or contract?
- Full-time for this Security Engineer - AppSec role at Rain.
From the original posting
About the Team
Security Engineering is a small team that answers one question: was it built right? We run our own AI-driven red team against Rain's code and cloud, gate pull requests before they merge, and write the baselines that say how every system should be configured. Our blockchain work is covered. This role owns everything else: the backend services, APIs, cloud, and edge that move real money for real customers.
We work closely with Security Operations: we give them high-quality findings to coordinate fixes for, and clear configuration rules they can build detections on.
About the Team
Security Engineering makes sure Rain is built right. We run our own AI-driven red team against our code and cloud, gate pull requests before they merge, and set the baselines for how every system is configured. This role owns everything outside blockchain: the backend services, APIs, cloud, and edge that move real money. We give Security Operations high-quality findings to coordinate fixes for, and clear configuration rules to build detections on.
About the Role
You'll be Rain's application security expert and the quality bar for every non-chain finding we produce. The calls are yours: what's real, how bad it is, and what has to be fixed before launch. You'll hold the line with engineers when it matters, and make the case so they agree, not just comply.
What You'll Do
Review red team findings before they reach engineers: reproduce them, cut false positives, set severity, and write tickets clear enough to fix without a meeting. Improve the scoring that grades them
Harden our backend services and APIs, especially the money-moving paths. You'll often write the fix yourself
Own edge defenses: DDoS protection, rate limiting, WAF rules, and abuse controls
Write secure configuration baselines for our cloud, code, and SaaS, and turn them into automated checks
Grow our PR security gate so more bugs are blocked before merge
Own attack surface coverage, and run architecture reviews on new and high-risk systems
Find, test, and pick the best security tools, whether we buy, adopt, or build
What We're Looking For
4+ years in application security, product security, or security-minded backend engineering
You've owned security decisions. You can tell a senior engineer their design needs to change and keep a good working relationship
You can read an unfamiliar codebase (TypeScript/Node.js) and find the bug that matters, and you know a scary-sounding finding from a real one
Hands-on cloud security (ideally GCP), Terraform, and edge defenses like WAFs and rate limiting
Experience with threat models or architecture reviews. You've run tool bake-offs and dropped tools that didn't earn their cost
You'd rather ship a check than write a document, and you use AI tools heavily without trusting them blindly
Bonus Attributes
Fintech, payments, or card issuing background (PCI DSS a plus)
Pentest, bug bounty, or red team experience
Experience building security scanners, static analysis rules, or LLM-based review tools
If you have the background: AI security for our agents and agentic payments, or corporate security alongside IT
Standard company text repeated across Rain's postings is omitted here.