Product Security Engineer, Alpaca

• If you’re excited about security, cutting edge financial tech, and thrive in a fast-paced environment, we’d love to hear from you
• The role requires a deep understanding of Cybersecurity principles, application security, DevSecOps, incident response, cloud security, offensive security, and proactive threat detection with a proven track record of managing security risks and cross functional collaboration
• Excited about Alpaca’s mission and what we’re building
• 6-8 years of mixed experience in a security operations, security engineering, product security, and DevSecOps
• Proficiency in at least one programming language (e.g., Go, Python etc.) and the ability to review and write secure code
• Experience with API security (e.g., OAuth, JWT, WAF, rate limiting)
• Experience with cloud security (e.g., Google Cloud, AWS) including DevSecOps and embedding security in the CI/CD pipeline
• A strong understanding of how to secure containerized environments (e.g., Kubernetes, Docker)
• Familiarity with security tools such as static code analyzers, vulnerability scanners, and penetration testing frameworks
• Knowledge of common security vulnerabilities (e.g., OWASP Top 10) and mitigation strategies
• Strong analytical and problem-solving skills
• Excellent communication skills and committed to work collaboratively across the Firm
• Comfortable thriving in a distributed, remote-first team with asynchronous collaboration across time zones
• A curious mindset, empathy for our users and teams, and a commitment to accountability—aligned with Alpaca’s core values of "Stay Curious," "Have Empathy," and "Be Accountable."
• Available for on-call rotations and after hour responses as needed

Desirable

• We are seeking an experienced Product Security Engineer who can help expand our Security efforts and play a critical role in safeguarding Alpaca’s assets from evolving cyber threats to ensure the security and integrity of our products
• In this role, you will play a key part in ensuring the security of Alpaca’s products and infrastructure, protecting our APIs, trading platforms, and customer data from threats
• You’ll collaborate closely with our engineering, product, and operations teams to embed security best practices into our development lifecycle, harden our systems, and respond to emerging threats
• The Security Team is 100% distributed and remote
• This role will be reporting directly to the CISO
• Collaborate with Product, Engineering, and DevOps to embed security into our API and platform development lifecycle, working hand-in-hand with our Engineering and Product teams
• Perform threat modeling and security reviews to spot risks early and keep our products secure
• Identify, triage, and remediate security vulnerabilities in our codebase, infrastructure, and third-party dependencies, and help respond and manage our bug bounty program
• Build and tweak automation tools for security testing and monitoring
• Participate in security incident response efforts, including investigation, containment, and post-mortem analysis, to ensure rapid resolution and continuous improvement
• Harden our cloud systems (Google Cloud, Kubernetes) and products to meet industry standards and protect against evolving threats
• Team up with product and DevOps crews to make security seamless without slowing us down
• Promote a security-first mindset by providing guidance, training, and documentation to team members on secure coding practices and emerging threats
• Assist with compliance audits and assessments as necessary
• Conduct security research and contribute to the development of new security tools and techniques