Senior Security Engineer

About GoodLeap

GoodLeap provides financing and software solutions for sustainable home products. Our platform has facilitated over $30 billion in financing since launch, making green technology affordable for millions of homeowners across the United States.

Position Overview

The Security Team at GoodLeap safeguards organizational assets while enabling business growth through product safety and resilience. As a Senior Product Security Engineer, you will partner directly with engineering teams to ensure what we ship is safe by default. You will split your time between building production security services (backends in TypeScript, Node.js, .NET, Python) and reviewing code designs before they are written.

Key Responsibilities

• AI Security: Adversarially test our LLM-backed features against prompt injection, jailbreaks, tool abuse, and data exfiltration. Define criteria for what is "safe enough to launch" in regulated consumer finance.
• Service Development: Build backend services, APIs, streaming transports, and CLI interfaces using modern stacks (TypeScript/Node.js/.NET/Python). Maintain high test coverage and CI pipelines.
• Vulnerability Management: Triage pull request findings from scanning tools to separate noise from real risks. Perform manual deep-dive testing of auth paths and high-risk changes.
• Threat Modeling: Review Product Requirement Documents (PRDs) before code exists, infer trust boundaries in unfamiliar domains, and raise security questions early when it is cheapest to fix them.
• Infrastructure & Automation: Secure IAM scoping, secrets management, container lifecycle, and network egress control using Infrastructure as Code. Automate repetitive tasks like SAST tuning and finding routing.

Required Skills

We seek an engineer who ships production code across modern stacks (TypeScript, Node.js, .NET, Python). You must be able to read unfamiliar source code well enough to judge reported vulnerabilities. Deep knowledge of identity failures (OAuth pitfalls, token exchange) and API standards (REST/GraphQL security, rate limiting) is essential.

You should have practical experience attacking LLM-backed applications or agents in a lab, CTF, or research setting. Strong communication skills are required to explain complex findings to product managers and executives without using excessive jargon.

Preferred Qualifications

• Owning an AppSec tooling estate (SAST/SCA tuning).
• Contributing to security policy or standards for AI systems.
• Depth in cryptography, key management, and incident response.

Compensation

$146,000 - $169,600 annually plus bonus eligibility. Visa sponsorship is not available for this role.