Senior Software Engineer, Security Platform

Compensation:

The salary range for this role is $5,000 - $9,500 per month (Gross in USD). For this senior role, with 6+ years of experience, the compensation range is $5,000 - $9,500 USD based on experience level per month and in gross amount. This range acknowledges the strong expertise and significant contributions expected at this level. This is a fully remote role.

About Sezzle:

With a mission to financially empower the next generation, Sezzle is revolutionizing the shopping experience beyond payments, blending cutting-edge tech with seamless, interest-free installment plans that make shopping smarter and more accessible. As we continue to shape the future of fintech and retail, we're building an innovative, dynamic team passionate about creating more than just a transaction but a truly unique shopping journey.

About the Role:

We are seeking a hands-on Senior Software Engineer, Security Platform, to build and own the platform the security team runs on: the services that discover, scan, triage and route security findings, the event-driven bus that connects them, and the CI security gates every team's pipeline runs through.

This is a development role on the security team, not a security-analyst role. Most of your time goes into designing, building and operating services in Go and Python on Kubernetes. Your job is to make these systems fast, low-noise, and reliable enough to be trusted by default without slowing delivery.

You will report to the Director of Information Security and work alongside the engineers who own detection and response and network and zero trust.

At Sezzle, AI-assisted engineering is a standard part of how we build. In this role you will build reusable agentic workflows (Claude Code skills, CI review agents, automated triage and verification) that multiply what the team can cover, and hold that review discipline in the platform code you own.

What You'll Do:

• Design, build, and operate security engineering services primarily in Golang and Python, on AWS and Kubernetes.
• Own the event-driven platform between the security services: the NATS bus, its contracts and consumers, delivery guarantees and observability.
• Integrate the platform end-to-end: scanners, finding system-of-record, tickets, and metrics, so remediation state is visible and exam evidence is a by-product of engineering.
• Own delivery of the security gates: SAST, SCA, secret detection, container and IaC scanning, including scanner selection and tuning, suppression workflow mechanics, false-positive burn-down, and rollout tooling that takes a gate from advisory reporting to enforcing without blocking delivery.
• Build agentic security workflows: CI review agents, automated finding triage and verification, remediation helpers.
• Build the triage-to-remediation automation: validate true positives, then automate reproduction context, fix guidance, and routing to owning teams and vulnerability-management operations.
• Participate in threat modeling and secure design reviews for the services you build and the pipelines you own.
• Participate in the on-call rotation for the services you own.

What We Look For:

• 6+ years of professional software engineering experience, including significant backend experience.
• Deployed significant changes to a production application in the past 30 days.
• Strong proficiency in Golang, plus working proficiency in Python.
• Hands-on experience building and operating event-driven or message-based systems (NATS, Kafka, or similar): contracts, idempotent consumers, replay, back-pressure.
• Hands-on experience building and operating CI/CD pipeline tooling. GitLab CI at fleet scale is a strong plus.
• Hands-on web application security knowledge, including the OWASP Top 10 in real code.
• Hands-on experience with SAST, SCA, and secret-scanning tooling (e.g., Semgrep, CodeQL, Snyk, Trivy, Grype, gitleaks), including tuning them to a signal-to-noise ratio developers will tolerate.
• Demonstrated AI-forward engineering: you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) and have built agentic workflows that other engineers adopted.
• Working knowledge of AWS and Kubernetes as deployment targets for the services you build.

Preferred Knowledge and Skills:

• Experience in fintech, payments, BNPL, or consumer lending, especially with systems in cardholder-data or regulated scope.
• Working knowledge of PCI DSS and SOC 2 as they apply to software development and change management.
• Software supply-chain integrity: SBOM pipelines, dependency governance, artifact signing and provenance (Sigstore, SLSA).
• Familiarity with policy-as-code and admission control (OPA, Kyverno, conftest).
• Exposure to bug bounty or external vulnerability report triage.
• Experience with threat modeling at a system level.

About You:

• You measure yourself by other teams' code: a fix you shipped is good; a vulnerability class that stopped appearing across the fleet is better.
• You'd rather ship a gate than publish a policy. You build the enforcement so well that engineers want to keep it.
• You have relentlessly high standards. You make sure that defects do not get sent down the line and that problems are fixed so they stay fixed.
• You're not bound by convention. Your success lies in developing new ways to do things.
• You need action. Speed matters in business, and you value calculated risk-taking.
• You earn trust: you listen attentively, speak candidly, and treat others respectfully.
• You have backbone; disagree, then commit. You can respectfully challenge decisions, and once a decision is determined, you commit wholly.
• You deliver results. Despite setbacks, you rise to the occasion and never settle.

Sezzle's Technology Stack:

• Languages: Golang, Typescript, Python
• Frontend: Typescript, React and React Native
• Backend: Golang
• Database: MySQL, Postgres, Elasticsearch
• DevOps & Cloud: AWS, Kubernetes
• Version Control: Git
• CI/CD: Gitlab
• Testing: Developer and AI-driven, focus on automated end-to-end, integration, and unit tests
• Open Source: Sezzle is focused on using open source, and we build what we can before buying!

What Makes Working at Sezzle Awesome?

At Sezzle, we are more than just brilliant engineers, passionate data enthusiasts, out-of-the-box thinkers, and determined innovators. Our culture is not defined by a certain set of perks designed to give the illusion of the traditional startup culture, but rather, it is the visible example living in every employee that we hire.