Security Lead Engineer, Whop
More information about location
Marketplace for communities, courses and software
Be an early applicant
Marketplace for communities, courses and software
101-200 employees
Be an early applicant
More information about location
101-200 employees
Company mission
To create a new paradigm of the internet – where connection, consumption, creation and commerce can happen all in one place.
Role
Who you are
- English-first communicator required — your writing goes directly to vendors, auditors, and customers without review
- The ideal candidate is a backend/infra engineer who evolved into security — you owned security at a startup because no one else would
- We are looking for a technical individual contributor to independently build these programs from scratch
- Highly technical — understands backend systems, infra, APIs, how things break. Can actually fix issues, not just identify them
- Extremely organized, high attention to detail
- High agency, scrappy, and urgent
- Extremely clear communicator - written and verbal
- Paranoid in the right way - thinks like an attacker to protect us
- Willing to push back, but trusted enough that people listen
- Highly available and responsive
- Always learning, loves to teach
- Builds systems that make you redundant over time
- 5+ years in security, has owned a program before
- Low-ego - cares about outcomes, not credit
- Uses modern tools (AI agents), and stays current on threat landscape
- Constantly monitors and adjusts what you ship
- Series A/B or high-growth startup experience preferred
What the job involves
- Whop is hiring our first dedicated security hire. You will work closely with our CTO to uplevel the team’s security posture
- This role is responsible for owning all security outcomes: infrastructure, compliance, external programs, and internal security
- You'll drive execution and hold an extremely high bar for our security posture. We are looking for someone highly technical – an engineer first
- We're mid-SOC2 with a handful of vendors supporting our IT and Security
- You'll inherit these relationships and make them yours, and work across every internal team to drive execution
- You'll work closely with the CTO, head of legal, chief of staff, and head of ops
- This is a hands-on role
- Own SOC2 and data privacy compliance (audits, GDPR, CCPA)
- Own infrastructure security (AWS, Vercel, Cloudflare, PlanetScale - secrets, access controls, monitoring)
- Own security incident response (detection, triage, remediation, post-mortems)
- Own external security programs (bug bounty, pen tests, threat monitoring)
- Own internal security (IT vendor, device security, office security, training)
- First line of escalation for all security issues
- Your first 90 days will look like the following:
- Within 30 days, you’ve audited our current security posture, met all stakeholders, and fully own the SOC 2 process and IT/security vendor relationships
- Within 60 days, you’ve taken Whop’s existing SOC 2 effort across the finish line (or are in final audit stages). Core infrastructure security is locked down, vendors are executing, and policies, runbooks, and incident response procedures are documented and in use
- Within 90 days, our external security program is live (bug bounty, pen tests, threat monitoring). You’re running security autonomously day-to-day, with the CTO only involved in major decisions. Teams are operating against clear security standards, and you’ve partnered with IT and Ops to improve physical and workplace security across our NYC and PA offices so Whop feels like a safe place to work for employees and customers
Our take
Navigating disparate marketplaces and leveraging guerrilla-style selling tactics on social media platforms such as Facebook can pose challenges for those aiming to sell communities and digital products. Whop steps in as a marketplace website and platform designed to streamline this process, aiding influencers, communities, and software sellers in reaching millions of eager customers seeking connection, education, and product acquisition.
Focusing on digital economies like online gambling, crypto trading, and gaming, Whop offers a marketplace for buyers with diverse subscription levels to access Discord, chatrooms, and apps. These avenues not only offer income opportunities for buyers but also serve as fertile ground for entrepreneurs seeking to tap into a vast customer base numbering in the millions.
While Whop's niche may not appeal to everyone in the manner of mainstream eCommerce platforms like Etsy, its robust customer base signals a growing trend of entrepreneurs seeking to monetise their online presence. The platform's social features mirror the culture and camaraderie prevalent in blockchain and crypto trading communities, indicating a sustained relevance and growing trajectory - backed by significant funding - in the foreseeable future.
Steph
Company Specialist at Welcome to the Jungle
Insights
68% employee growth in 12 months
Company
Company benefits
- Unlimited PTO, Health, Vision, and Dental coverage
- Brooklyn, New York | Check out our office here and here
- Daily $20 lunch, $25 dinner Uber Eats credits
- Hiring everywhere, hybrid company model
- State of the art gym access @ Equinox
- Latest 14 or 16 inch Macbook Pro
Company HQ
South Williamsburg, NY
Leadership
Steven Schwartz
(Co-Founder & CEO)Currently a Board Member at POSH. Previously CEO of Varfaj Partners, Technology Director at SoleStrike, and Summer Analyst at Accenture.
Jack Sharkey
(Co-Founder & CTO)Previously Co-Founder at Frosted, Business Technology Consultant at Lucratyva, Lead Developer and Project Manager at Varfaj Partners and Software Developer at Loeb.nyc.
Cameron Zoub
(Co-Founder & CGO)Previously Co-Founder at Frosted, Varfaj Partners and SoleStrike and COO of Conjug8.
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 11 more jobs at Whop