Lead Security Engineer

About the role

About Us

Salient builds AI agents for regulated financial services. Our agents automate loan servicing, compliance, collections, recovery, insurance claims, and disputes for banks, captives, and specialty lenders.

We are:

-

Backed by a16z and Y Combinator, with $75M raised in Series A funding

-

Cash flow positive and profitable, with mid eight figure ARR achieved in under two years

-

Already serving more than 20% of the auto lending industry

-

Processing millions of real customer calls and transactions every day

-

Fully deployed in production with major financial institutions

-

Actively expanding into new financial services segments

-

Building together in person in San Francisco

We are deeply integrated with our customers, own the full technology stack, and move quickly to bring modern AI into regulated industries where precision, reliability, and performance matter.

About the Role

We're hiring a hands-on Lead Security Engineer to build a repeatable security operating system for Salient. This is a Staff-level individual contributor role reporting to senior leadership. You will be our single dedicated security hire, with reserved support from infrastructure, IT, and People Operations.

You will own compliance operations, boundary testing, access and vulnerability management, detection and response, and the automation that makes all of it repeatable and provable. We'll sequence this work by risk together. We don't expect anyone to arrive as an expert in every area below.

What You'll Own

• The operating procedure for SOC 2, PCI, enterprise security questionnaires, and bank-specific security requirements, keeping implementation, approval, submission, and acceptance separate.

• Security testing across cloud/IAM, application, payment, and AI boundaries, including synthetic tests covering recordings, transcripts, logs, tools, storage, and providers.

• Investigation of access anomalies.

• Stronger IAM/PAM controls and monitoring.

• Network and vulnerability scanning, with every finding tracked through service-owner remediation and retest, or an authorized exception.

• Incident runbooks, useful detections, and proven handoffs between security, service teams, and backup personnel.

• Automation for security controls and evidence: tested evidence connectors, asset reconciliation, obligation tracking, and claim-review workflows.

What We're Looking For

• You own outcomes end to end and ship weekly with a small team, deciding with incomplete information.

• You're a software engineer first: you write production-quality code and build tested tooling and automation.

• You have hands-on experience securing cloud infrastructure and identity and access (IAM/PAM), including investigating suspicious access.