Security Engineer – Application Security

About the role

Rain is looking for an Application Security Engineer to own the security of its backend services, APIs, cloud, and edge infrastructure. You will be the primary security expert for non‑blockchain findings, working closely with engineers and Security Operations to ensure secure, compliant delivery of money‑moving features.

Key responsibilities

• Review and triage red‑team findings, reproduce issues, cut false positives, set severity, and create clear remediation tickets.
• Harden backend services and APIs, often writing fixes yourself, especially for money‑moving paths.
• Own edge defenses such as DDoS protection, rate limiting, WAF rules, and abuse controls.
• Write secure configuration baselines for cloud, code, and SaaS and automate their enforcement.
• Expand the PR security gate to block bugs before merge and run architecture reviews for new high‑risk systems.
• Evaluate, test, and select security tools, whether purchased, adopted, or built in‑house.

Required profile

• 4+ years of experience in application security, product security, or security‑focused backend engineering.
• Proven ability to make security decisions and influence senior engineers while maintaining strong working relationships.
• Comfort reading unfamiliar TypeScript/Node.js codebases and distinguishing real threats from noise.
• Hands‑on experience with cloud security (preferably GCP), Terraform, and edge defenses like WAFs and rate limiting.
• Experience conducting threat models, architecture reviews, and tool bake‑offs.

Required skills

• TypeScript
• Node.js
• Google Cloud Platform (GCP)
• Terraform
• Web Application Firewall (WAF)
• Rate limiting
• Red‑team tooling and methodology
• Threat modeling and architecture review

What we offer

• Unlimited vacation (minimum 10 days per year)
• Flexible remote work setup with home‑office stipend
• Comprehensive health, dental, vision coverage (95% employee, 90% dependents)
• 401(k) with 4% company match
• Equity option plan for all employees
• Monthly health‑and‑wellness stipend
• In‑office meals via DoorDash credit and regular team summits/offsites