Finix

Developer-friendly API for payment processing

Offensive Security Engineer

Offensive Security & TestingPosted on Nov 11

Full-timeSan Francisco, CA, USA

About the Job

Requirements

At least 4 years of hands-on offensive security experience, such as penetration testing, red teaming, or application security testing.
Deep web application and application programming interface testing skills.
Experience attacking cloud environments, especially Amazon Web Services.
Proficiency in Python or Go, ability to read and review Java code, and mastery of tools such as Burp Suite.
Hands-on experience using frontier artificial intelligence models in offensive security work, such as AI-assisted code review, fuzzing, or automated testing agents.
Ability to explain findings and risk to engineers and non-technical stakeholders.
Sound judgment and respect for scope and rules of engagement when testing production-adjacent systems.

Responsibilities

Plan and run red team tests across web applications, application programming interfaces, Amazon Web Services infrastructure, Kubernetes, and the corporate environment.
Perform Payment Card Industry Data Security Standard penetration testing and segmentation testing for the cardholder data environment as a Level 1 service provider.
Test new features and architecture changes, and partner with Engineering on threat modeling and secure design.
Review source code, especially Java services, for security flaws, and help engineers understand and fix them.
Run purple team exercises with detection and incident response to validate and improve alerting.
Validate and reproduce bug bounty and third-party penetration test findings, and assess their real-world impact.
Write clear reports with reproducible steps, business impact, and practical remediation guidance, and retest fixes.
Build tooling and automation to scale offensive testing and catch regressions.
Use frontier artificial intelligence models to accelerate offensive testing, including building AI-assisted workflows and agents for reconnaissance, code review, vulnerability discovery, and exploit validation.
Deploy and operate self-hosted artificial intelligence models for security testing so source code, findings, and sensitive data stay inside Finix’s environment.
Test internal artificial intelligence tooling and large language model integrations for prompt injection, data leakage, and abuse.

Desired Qualifications

Published Common Vulnerabilities and Exposures, security research, conference talks, or recognition in bug bounty programs.
Capture the Flag experience.
Kubernetes and container security testing, including Amazon Elastic Kubernetes Service.
Mobile or Android application testing.
Active Directory, Okta, or identity provider attack techniques.
Familiarity with payment systems, such as card networks, hardware security modules, or ISO 8583.
Large language model and artificial intelligence application security testing.

About Finix

Finix is building the global operating system for fintech, starting with payments. From startups to publicly traded companies, Finix processes tens of billions of dollars annually both in-store and online. Finix was founded in 2015 and is headquartered in San Francisco.

To date Finix has raised over $200M, including a $75M Series C led by Acrew Capital and Lightspeed Venture Partners and backed by American Express Ventures, Bain Capital Ventures, Homebrew, Inspired Capital, Visa, and others

About the Role:

The Engineering organization at Finix owns the delivery and stability of our product end to end. As an Offensive Security Engineer, you will find weaknesses in Finix’s applications, cloud infrastructure, and corporate environment before attackers do, and work with engineers to fix them. You will run our internal penetration testing program and work closely with Engineering, Information Security, Compliance, and IT.

This is an in-office position based in our San Francisco office.

You Will:

Plan and run red team tests across our web applications, APIs, AWS infrastructure, Kubernetes, and corporate environment

Perform PCI DSS penetration testing and segmentation testing for our cardholder data environment as a Level 1 service provider

Test new features and architecture changes, and partner with Engineering on threat modeling and secure design

Review source code, especially Java services, for security flaws, and help engineers understand and fix them

Run purple team exercises with detection and incident response to validate and improve our alerting

Validate and reproduce bug bounty and third-party pentest findings, and assess their real-world impact

Write clear reports with reproducible steps, business impact, and practical remediation guidance, and retest fixes

Build tooling and automation to scale offensive testing and catch regressions

Use frontier AI models to accelerate offensive testing, including building AI-assisted workflows and agents for recon, code review, vulnerability discovery, and exploit validation

Deploy and operate self-hosted AI models for security testing, so source code, findings, and sensitive data stay inside Finix’s environment

Test internal AI tooling and LLM integrations for prompt injection, data leakage, and abuse

You Have:

4+ years of hands-on offensive security experience, such as penetration testing, red teaming, or application security testing

Deep web application and API testing skills

Experience attacking cloud environments, especially AWS

Proficiency in Python or Go, the ability to read and review Java code, and mastery with tools like Burp Suite

Hands-on experience using frontier AI models in offensive security work, such as AI-assisted code review, fuzzing, or automated testing agents

Strong ability to explain findings and risk to engineers and non-technical stakeholders

Sound judgment and respect for scope and rules of engagement when testing production-adjacent systems

Nice to Have:

Published CVEs, security research, conference talks, or recognition in bug bounty programs

CTF experience

Kubernetes and container security testing (EKS)

Mobile or Android application testing

Active Directory, Okta, or identity provider attack techniques

Familiarity with payment systems, such as card networks, HSMs, or ISO 8583

LLM and AI application security testing

-----------------------------------------

Finix is an equal opportunity employer and values diversity. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or any other protected class.

Role: Security Engineer
Level: IC4-IC5
Location: San Francisco, CA
Compensation Range: $180,000 - $230,000/year + Equity + Benefits

Our salary ranges are determined by role, level, and location. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries at our headquarters in San Francisco, California. Individual pay is determined by work location, job related skills, experience, and relevant education or training.

About the Company

Finix

Developer-friendly API for payment processing

Finix provides a payment processing platform for software platforms, offering a developer-friendly API that lets SaaS providers, marketplaces, and e-commerce sites accept payments, handle merchant onboarding, and manage payouts. The API integrates into existing software to streamline payments and reduce operational complexity. It earns revenue by charging fees for API usage and related services, such as transactions or subscriptions. Finix differentiates itself by delivering a clean, easy-to-integrate payment solution that emphasizes reliability, security, and scalable payout and onboarding capabilities, enabling clients to grow revenue and cut costs instead of building payments from scratch. The company’s goal is to help software platforms run their payments efficiently, unlock more revenue from payment operations, and reinvest that income into their core products and teams.

Company size: 201-500
Company stage: Series C
Total funding: $200.5M
Headquarters: San Francisco, CA
Founded: 2015

Recently Posted Jobs

Explore more opportunities at Finix

See more jobs