Lead the security function end-to-end at an early-stage B2B fintech: drive application and product security, threat modeling, secure design and code review, vulnerability remediation, cloud and Kubernetes hardening, logging and detection, incident response, and SOC 2 foundations. Define roadmap, embed security into engineering, and partner with teams to build secure-by-default products.
About Nuvo
About the Role
What You’ll Do:
What You Bring:
We’re Redefining the $11T B2B Commerce and Payments Market
Nuvo is bringing B2B commerce online.
While technology has reshaped consumer commerce, the business-to-business (B2B) economy — three times larger— has lagged behind.
From coffee to lumber, every product we use has been traded through a complex supply chain of suppliers, manufacturers, wholesalers, and retailers. Despite the massive scale of this market, most businesses manage their trading relationships and commerce activities using outdated methods like paper forms, PDFs, emails, faxes, phone calls, and spreadsheets, making processes slow and inefficient.
Much like how Shopify, Stripe and Square have transformed how consumer companies transact, we aim to do the same for B2B companies.
We are looking for a lead security engineer to stand up and own security at a company building category-defining products. Our problems span safe deployment of AI agents, multi-party workflow automation, identity, risk, and large-scale data, and because we handle sensitive financial information for businesses across the economy, trust is the product. As our first dedicated security hire, you'll define what good looks like: shaping the roadmap, embedding security into how we build, and protecting our customers and their data from day one. Since we’re an early startup, you’ll have to be prepared to wear many hats; most of your time will be spent on application and product security, but you'll also reach into cloud infrastructure, detection and response, and compliance as the work demands. Your impact will be felt across team culture, our customers, and the economy.
- Own application and product security end to end — threat modeling, secure design and code review, and partnering with engineers to ship features that are secure by default rather than secured after the fact.
- Build the security function from the ground up: set the roadmap, establish best practices, choose the tooling, and define the standards the rest of engineering will build on.
- Find, prioritize, and drive remediation of vulnerabilities across the product and our infrastructure and build the guardrails that keep them from coming back.
- Reach across the stack as needed — cloud and infrastructure hardening (IAM, secrets, network, Kubernetes), logging, detection and incident response, and the security foundations behind compliance efforts like SOC 2.
- Make security a part of engineering culture, to help the whole team move fast but securely. Write and review high-quality code, contribute to the systems you protect, and level up the team around you.
- Use the best tools for the job. We've used technologies like Vue, GraphQL, and even built our own DSL for defining roles and permissions. What matters most is the impact you create and the risk you reduce, not the specific tools you use.
- 5+ years in security engineering, with deep application/product security expertise and the range to operate across cloud, infrastructure, and detection when needed.
- A track record of building or substantially shaping a security program. You should be comfortable being the one who decides what to do first and why.
- Strong engineering fundamentals: you read and write production code, and you can earn the trust of the engineers you partner with.
- Strong problem-solving skills and the ability to communicate technical risk clearly to engineers, to leadership, and to customers.
- A passion for internet technologies and a sharp instinct for how modern systems get attacked and defended.
- Experience working in an early-stage engineering team or a fast-growing company, solving hard, ambiguous problems with a strong bias for action.
Expected Compensation Range $200,000-$300,000
Nuvo San Francisco, California, USA Office
1070 Maryland St, San Francisco, California, United States, 94107 4270
Similar Jobs
Financial Services
Leads software engineering for secure, stable, and scalable technology platforms. Designs, develops, tests, debugs, and reviews production code; improves application resiliency and operational stability; automates recurring remediation; and promotes secure AI-assisted development practices. Evaluates vendor and internal technical solutions, coaches engineers on responsible AI use, and applies cloud-native technologies, agile methodologies, and CI/CD across the software development lifecycle.
Top Skills:
Ai-Assisted Software DevelopmentAutomated TestingCi/CdCloud NativeSoftware Development Life Cycle (Sdlc)
Financial Services
Leads enterprise cybersecurity engineering and secure-design reviews across applications, cloud platforms, APIs, integrations, and third-party solutions. Conducts threat modeling, risk assessments, vulnerability remediation, and architecture evaluations; advises senior stakeholders on mitigations, compensating controls, and secure implementation. Promotes automation and AI-assisted security validation throughout the software development lifecycle, while ensuring data sensitivity, auditability, and resiliency. Partners with product, engineering, business, vendor, and technology teams and leads cybersecurity communities of practice.
Top Skills:
Api GatewaysApplication Programming Interfaces (Apis)Application SecurityArtificial Intelligence And Machine Learning (Ai/Ml)Cloud Access Security Broker (Casb)Identity And Access Management (Iam)Infrastructure SecurityMobile TechnologiesOauthProxy TechnologiesPublic CloudSAMLSecrets ManagementSecurity Information And Event Management (Siem)Security Monitoring PlatformsSecurity Service Edge (Sse)Service-To-Service AuthenticationTraffic InspectionZero Trust
AdTech • Artificial Intelligence • Marketing Tech • Software • Analytics
Lead application security engineering across the SDLC using AI-assisted threat modeling, automated security testing, vulnerability prioritization, and secure-by-default controls. Partner with Engineering, Product, QA, DevOps, and AI platform teams to secure applications, APIs, cloud infrastructure, data, and AI/ML systems. Build security automation, CI/CD controls, policy-as-code guardrails, developer enablement, and proactive defenses against emerging threats such as prompt injection and data poisoning.
Top Skills:
AIAi/MlAWSAzureBurp SuiteCi/CdContainer ScanningDastDjangoDockerFastapiGCPGithub Advanced SecurityIac ScanningInfrastructure-As-CodeJwtKubernetesNode.jsOauth2OidcOwasp ZapPolicy-As-CodeReactSastScaSemgrepSnykSonarqubeTrivy
What you need to know about the San Francisco Tech Scene
San Francisco and the surrounding Bay Area attracts more startup funding than any other region in the world. Home to Stanford University and UC Berkeley, leading VC firms and several of the world’s most valuable companies, the Bay Area is the place to go for anyone looking to make it big in the tech industry. That said, San Francisco has a lot to offer beyond technology thanks to a thriving art and music scene, excellent food and a short drive to several of the country’s most beautiful recreational areas.
Key Facts About San Francisco Tech
- Number of Tech Workers: 365,500; 13.9% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Google, Apple, Salesforce, Meta
- Key Industries: Artificial intelligence, cloud computing, fintech, consumer technology, software
- Funding Landscape: $50.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Sequoia Capital, Andreessen Horowitz, Bessemer Venture Partners, Greylock Partners, Khosla Ventures, Kleiner Perkins
- Research Centers and Universities: Stanford University; University of California, Berkeley; University of San Francisco; Santa Clara University; Ames Research Center; Center for AI Safety; California Institute for Regenerative Medicine
