Lead the security function end-to-end at an early-stage B2B fintech: drive application and product security, threat modeling, secure design and code review, vulnerability remediation, cloud and Kubernetes hardening, logging and detection, incident response, and SOC 2 foundations. Define roadmap, embed security into engineering, and partner with teams to build secure-by-default products.
About Nuvo
About the Role
What You’ll Do:
What You Bring:
We’re Redefining the $11T B2B Commerce and Payments Market
Nuvo is bringing B2B commerce online.
While technology has reshaped consumer commerce, the business-to-business (B2B) economy — three times larger— has lagged behind.
From coffee to lumber, every product we use has been traded through a complex supply chain of suppliers, manufacturers, wholesalers, and retailers. Despite the massive scale of this market, most businesses manage their trading relationships and commerce activities using outdated methods like paper forms, PDFs, emails, faxes, phone calls, and spreadsheets, making processes slow and inefficient.
Much like how Shopify, Stripe and Square have transformed how consumer companies transact, we aim to do the same for B2B companies.
We are looking for a lead security engineer to stand up and own security at a company building category-defining products. Our problems span safe deployment of AI agents, multi-party workflow automation, identity, risk, and large-scale data, and because we handle sensitive financial information for businesses across the economy, trust is the product. As our first dedicated security hire, you'll define what good looks like: shaping the roadmap, embedding security into how we build, and protecting our customers and their data from day one. Since we’re an early startup, you’ll have to be prepared to wear many hats; most of your time will be spent on application and product security, but you'll also reach into cloud infrastructure, detection and response, and compliance as the work demands. Your impact will be felt across team culture, our customers, and the economy.
- Own application and product security end to end — threat modeling, secure design and code review, and partnering with engineers to ship features that are secure by default rather than secured after the fact.
- Build the security function from the ground up: set the roadmap, establish best practices, choose the tooling, and define the standards the rest of engineering will build on.
- Find, prioritize, and drive remediation of vulnerabilities across the product and our infrastructure and build the guardrails that keep them from coming back.
- Reach across the stack as needed — cloud and infrastructure hardening (IAM, secrets, network, Kubernetes), logging, detection and incident response, and the security foundations behind compliance efforts like SOC 2.
- Make security a part of engineering culture, to help the whole team move fast but securely. Write and review high-quality code, contribute to the systems you protect, and level up the team around you.
- Use the best tools for the job. We've used technologies like Vue, GraphQL, and even built our own DSL for defining roles and permissions. What matters most is the impact you create and the risk you reduce, not the specific tools you use.
- 5+ years in security engineering, with deep application/product security expertise and the range to operate across cloud, infrastructure, and detection when needed.
- A track record of building or substantially shaping a security program. You should be comfortable being the one who decides what to do first and why.
- Strong engineering fundamentals: you read and write production code, and you can earn the trust of the engineers you partner with.
- Strong problem-solving skills and the ability to communicate technical risk clearly to engineers, to leadership, and to customers.
- A passion for internet technologies and a sharp instinct for how modern systems get attacked and defended.
- Experience working in an early-stage engineering team or a fast-growing company, solving hard, ambiguous problems with a strong bias for action.
Expected Compensation Range $200,000-$300,000
Nuvo San Francisco, California, USA Office
1070 Maryland St, San Francisco, California, United States, 94107 4270
Similar Jobs
Information Technology
Lead technical security strategy and implementation for Managed Services platforms. Design and improve security controls, IAM, PAM, vulnerability management, incident response, and compliance. Embed secure-by-design and DevSecOps practices, mentor engineers, and partner with architecture, engineering, and operations to reduce risk and enable scalable growth.
Top Skills:
Azure SecurityCloud SecurityDevsecopsEndpoint ProtectionIamInfrastructure AutomationNetwork SecurityPlatform EngineeringPowershellPrivileged Access ManagementPythonSecure SdlcSecurity AutomationThreat DetectionZero Trust
Fintech • Financial Services
Lead and grow a global engineering team to design, deploy, operate, and migrate physical security platforms (Genetec access control and video). Drive Genetec migrations from legacy PACS/CCTV, manage updates/patches, onboard biometrics and video analytics, establish KPIs/OKRs, handle incident management, and partner with Network, Cybersecurity, Risk/Compliance, and Facilities.
Top Skills:
APIsBiometricsC-Cure 9000FirewallGenetec Security CenterLinuxMulticastPowershellPythonQosRoutingSIEMSQLTcp/IpUnicastVictor VideoVideo AnalyticsVlansVpnWindows
Consulting • Financial Services
Lead hands-on security engineer responsible for designing, implementing, hardening, automating, and optimizing enterprise security controls across cloud, identity, endpoint, network, email, and data protection. Builds and maintains security platforms (SIEM, SOAR, XDR/EDR), develops detection logic, automates workflows, supports incident response, and partners with cross-functional teams to raise security engineering maturity and reduce risk.
Top Skills:
Active DirectoryAmazon Web Services (Aws)APIsAzure Virtual Desktop (Avd)BashCasbDlpDnsEdrHttp/SKqlLdapLinuxMicrosoft 365AzureMicrosoft DefenderPkiPowershellPythonSIEMSmtpSoarSplTcp/IpVlansWindowsXdr
What you need to know about the San Francisco Tech Scene
San Francisco and the surrounding Bay Area attracts more startup funding than any other region in the world. Home to Stanford University and UC Berkeley, leading VC firms and several of the world’s most valuable companies, the Bay Area is the place to go for anyone looking to make it big in the tech industry. That said, San Francisco has a lot to offer beyond technology thanks to a thriving art and music scene, excellent food and a short drive to several of the country’s most beautiful recreational areas.
Key Facts About San Francisco Tech
- Number of Tech Workers: 365,500; 13.9% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Google, Apple, Salesforce, Meta
- Key Industries: Artificial intelligence, cloud computing, fintech, consumer technology, software
- Funding Landscape: $50.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Sequoia Capital, Andreessen Horowitz, Bessemer Venture Partners, Greylock Partners, Khosla Ventures, Kleiner Perkins
- Research Centers and Universities: Stanford University; University of California, Berkeley; University of San Francisco; Santa Clara University; Ames Research Center; Center for AI Safety; California Institute for Regenerative Medicine
