Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 42 hours agoWe saw it 76 min after it went up

Offensive Security Engineer

Finix Payments27 open roles

Pay
$180,000 – $230,000 a year
Where
San Francisco
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowOffensive Security EngineerFinix Payments · San Francisco

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Finix Payments's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. Finix Payments postings stay open a median of 74 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 42 hours ago

Finix Payments median: 74 days open

The posting

About Finix

Finix is building the global operating system for fintech, starting with payments. From startups to publicly traded companies, Finix processes tens of billions of dollars annually both in-store and online. Finix was founded in 2015 and is headquartered in San Francisco.

To date Finix has raised over $200M, including a $75M Series C led by Acrew Capital and Lightspeed Venture Partners and backed by American Express Ventures, Bain Capital Ventures, Homebrew, Inspired Capital, Visa, and others

About the Role:

The Engineering organization at Finix owns the delivery and stability of our product end to end. As an Offensive Security Engineer, you will find weaknesses in Finix’s applications, cloud infrastructure, and corporate environment before attackers do, and work with engineers to fix them. You will run our internal penetration testing program and work closely with Engineering, Information Security, Compliance, and IT.

This is an in-office position based in our San Francisco office.

You Will:

  • Plan and run red team tests across our web applications, APIs, AWS infrastructure, Kubernetes, and corporate environment
  • Perform PCI DSS penetration testing and segmentation testing for our cardholder data environment as a Level 1 service provider
  • Test new features and architecture changes, and partner with Engineering on threat modeling and secure design
  • Review source code, especially Java services, for security flaws, and help engineers understand and fix them
  • Run purple team exercises with detection and incident response to validate and improve our alerting
  • Validate and reproduce bug bounty and third-party pentest findings, and assess their real-world impact
  • Write clear reports with reproducible steps, business impact, and practical remediation guidance, and retest fixes
  • Build tooling and automation to scale offensive testing and catch regressions
  • Use frontier AI models to accelerate offensive testing, including building AI-assisted workflows and agents for recon, code review, vulnerability discovery, and exploit validation
  • Deploy and operate self-hosted AI models for security testing, so source code, findings, and sensitive data stay inside Finix’s environment
  • Test internal AI tooling and LLM integrations for prompt injection, data leakage, and abuse

You Have:

  • 4+ years of hands-on offensive security experience, such as penetration testing, red teaming, or application security testing
  • Deep web application and API testing skills
  • Experience attacking cloud environments, especially AWS
  • Proficiency in Python or Go, the ability to read and review Java code, and mastery with tools like Burp Suite
  • Hands-on experience using frontier AI models in offensive security work, such as AI-assisted code review, fuzzing, or automated testing agents
  • Strong ability to explain findings and risk to engineers and non-technical stakeholders
  • Sound judgment and respect for scope and rules of engagement when testing production-adjacent systems

Nice to Have:

  • Published CVEs, security research, conference talks, or recognition in bug bounty programs
  • CTF experience
  • Kubernetes and container security testing (EKS)
  • Mobile or Android application testing
  • Active Directory, Okta, or identity provider attack techniques
  • Familiarity with payment systems, such as card networks, HSMs, or ISO 8583
  • LLM and AI application security testing

-----------------------------------------

Finix is an equal opportunity employer and values diversity. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, disability status, or any other protected class.

Role: Security Engineer Level: IC4-IC5 Location: San Francisco, CA Compensation Range: $180,000 - $230,000/year + Equity + Benefits

Our salary ranges are determined by role, level, and location. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries at our headquarters in San Francisco, California. Individual pay is determined by work location, job related skills, experience, and relevant education or training.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Finix Payments's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Finix Payments's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Finix Payments's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.