DevSecOps Engineer

Coast is re-imagining the trillion-dollar U.S. B2B card payments infrastructure, with a focus on the country’s 500,000 commercial fleets, 40 million commercial vehicles, and many million commercial drivers. The incumbent technologies that cater to these customers are decades old, and drivers, fleets, and the merchants that serve them all increasingly demand modern digital experiences and affordable and transparent financial services products. Coast's mission is to deliver them at a transformational scale, and to improve working lives in one of the country’s biggest industry sectors. The company is backed by top fintech and mobility venture funds. Coast is competing and winning with software, and we are building a world-class engineering team. This is a unique opportunity to get in on the ground level early on, contribute in myriad ways, drive foundational decisions and expand your impact as the business grows, have fun, and learn a ton in the process. If you’re practical and business-minded, smart and creative, and excited about the rewards and the energy of an early-stage venture-backed startup, we’d love to hear from you. The DevSecOps Engineer is our first explicitly security-focused hire. In this role you will be an early member of the Platform Engineering organization and help us mature a critical part of Coast. We value speed and flexibility, but accept the need for high standards for compliance and security. Doing it well is critical for our ability to execute. Working directly with an enthusiastic and invested product team, you will help us stay on top of a wide array of areas, from network security and least-privilege permissions in the cloud to rationalizing our SIEM and code scanning posture, from supply chain security to application security reviews for our product organization. At the end of the day, we want to establish “paved paths” that allow us to minimize friction while ensuring security of our software. The role will work closely with our Product Engineering, and the CTO; this role reports to the Head of Platform. We are hiring in NYC and the tri-state area only. Our NYC office is located in the heart of Manhattan’s SoHo neighborhood, benefiting from its vibrant creative energy. The whole company is in the office on average 4 days a week. The DevSecOps Engineer will: Hold a high bar for security standards and help us establish best practices; Influence design and implementation of all aspects of our product, by acting as a sounding board and SME for our product managers and engineers; Improve scanning to ensure that risks in our codebase and cloud environment are identified, assessed, and remediated in a timely manner; Organize our permissioning system to ensure that the right people have appropriate access, and unnecessary people don’t; Help shape the engineering culture of the company by championing security practices; Maintain comprehensive documentation of the security infrastructure, policies, and procedures; Remain relentlessly pragmatic and balance the product velocity demand with the needs of a secure platform. The DevSecOps Engineer must : Have 5+ years experience working with first-class engineering teams with a proven track record of continually improving their employer’s security posture; Have experience working directly with product engineers to incrementally improve our practices; Be proficient at automating tooling, whether it be using the shell or (preferably) a programming language such as Python; Have experience with one of Terraform/CloudFormation/Pulumi/CDK since we treat our infrastructure as code; Deep hands-on knowledge and experience developing in AWS, especially IAM and SIEM, but also networking; Be able to figure stuff out - the modern security space is deep and complex, and there are many ways of solving the same problem. You need to be able to go off on your own, research and design a solution, implement technical spikes, and then deliver it with the team; Have ... (truncated, view full listing at source)