⚡️ Founding Full Stack Software Engineer ⚡️

About the role

tl;dr

We're rebuilding bank compliance as an engineering problem. Today, auditors sample 5% of a fintech's files by hand and write findings in spreadsheets. We run the actual math on 100% of them — every dispute, every statement, every adverse-action notice — with deterministic rules and LLM-as-judge evaluation. You'll be one of the first engineers, building the agents and pipelines that reperform a bank's compliance at population scale. If you've shipped real LLM systems and want them to do something that matters, let's talk.

Why this exists

Before a fintech can issue a loan, send a statement, or resolve a dispute, its partner bank has to prove the whole operation followed the rules — Reg E, TILA, FCRA, SCRA, UDAAP, and dozens more. The way that's checked today hasn't changed in decades: consultants pull a small sample, eyeball it, and hope the other 95% looks the same.

It usually doesn't. On one Reg E engagement we reperformed the error-resolution math on 14,000+ disputes and surfaced timing and provisional-credit violations that no sample would have caught. On a TILA engagement we rebuilt daily balances and finance charges from raw platform data and found a systematic interest-method bug the bank had been disclosing incorrectly for months.

That's the wedge: compliance testing is a verification problem, and verification problems are engineering problems. We test everything, we show our work, and we hand banks evidence an examiner will accept.

The founders

Esty (CEO) dropped out of NYU's CS program at 19 and taught herself security well enough to earn the CISSP and OSCP. She built AI-based security systems at Invoca and led R&D at Buggy before this, and she still approaches compliance the way she approached pentesting — assume the system is broken and go find where.

Bivu (CTO) spent a decade in ML engineering, including leading IVR fraud detection at Pindrop — a system that six of the ten largest U.S. banks now run in production.

Shiboleth started as a deepfake-audio-detection research project that ended up on stage at Black Hat and then in TechCrunch. The through-line we kept hitting: security had matured into a real engineering discipline with continuous monitoring and standards, and compliance — a bigger, more regulated market — had almost none of that. We started Shiboleth to close that gap.

What you'll work on

- Agentic reperformance. Building agents that reconstruct what a statement, notice, or dispute resolution should have been from raw data — recalculating minimum payments, interest, and finance charges, then comparing against what the consumer actually received.

- Context engineering for regulation. Turning dense regulatory text and bank-specific test requirements into specifications an LLM-as-judge can apply consistently across populations of hundreds of thousands of records.

- Population-scale pipelines. Ingestion, normalization, and PII redaction over messy SFTP/PGP feeds and warehouse data, feeding deterministic SQL rules and model-based evaluation.