Scale Engineer

Staff Product Security Engineer

Security Engineer · Staff · Full Time

US - San FranciscoUSD 220k – 280k5d ago
Apply for this role

Opens Airwallex's application page

Role

What you'll do.

Staff Product Security Engineer at Airwallex, a regulated AI-native financial operating system serving 675,000+ businesses globally. This role requires 8+ years of security engineering and incident response expertise, deep cloud platform knowledge, and hands-on experience with threat detection, incident response, and infrastructure security to protect mission-critical financial systems across North America, Europe, the Middle East, and Asia-Pacific.

Responsibilities

  • Design and Deploy Security Controls: Architect and implement security controls that enable secure scaling across Airwallex's infrastructure. This includes developing application-level and infrastructure-level controls that integrate with CI/CD pipelines and modern cloud architectures to protect against evolving threat landscapes.
  • Develop Threat Detection and Response Strategies: Design and operationalize detection engineering strategies using SIEM platforms like Splunk, coupled with automated response workflows. Establish detection baselines for common attack patterns, develop playbooks for incident response teams, and continuously optimize detection accuracy to improve mean time to respond (MTTR).
  • Conduct Threat Intelligence and Forensic Analysis: Collect, analyze, and operationalize threat intelligence from endpoint, network, and cloud telemetry. Perform tactical forensics and threat hunting activities to identify indicators of compromise (IOCs), understand attacker techniques, and strengthen defensive capabilities against sophisticated threats.
  • Manage Cybersecurity Infrastructure: Design, implement, and maintain cybersecurity infrastructure spanning cloud platforms (GCP, AWS, Alibaba Cloud), identity management systems (Okta, GSuite), and security monitoring tools. Ensure infrastructure resilience through proper configuration management, testing, and operational excellence.
  • Lead Incident Response and Investigations: Investigate, contain, and respond to cybersecurity incidents with depth and quality. Lead cross-functional incident response efforts, document lessons learned, and implement long-term mitigations to reduce organizational risk and prevent recurrence.
  • Identify and Remediate Vulnerabilities: Assess system and network security postures by identifying vulnerabilities, misconfigurations, and remediation opportunities. Leverage automated scanning tools, manual testing, and code review practices to maintain a strong security baseline across applications and infrastructure.
  • Embed Security into Product Development: Partner with product, engineering, and infrastructure teams to embed security considerations into new and existing applications, software, and services. Drive continuous security improvement by advocating for secure development practices, threat modeling, and security architecture reviews.
  • Support Defensive Operations and Threat Hunting: Conduct proactive threat hunting activities to identify anomalies and potential threats before they escalate. Support 24/7 defensive operations teams with deep technical expertise in threat analysis, evasion techniques, and advanced investigation methodologies.

Qualifications

What we look for.

Technical

  • SIEM and Security Monitoring Platforms

    Advanced proficiency with Splunk or similar security information and event management (SIEM) platforms for log aggregation, threat detection rule development, and forensic investigation. Experience tuning detections and building dashboards is highly valued.

  • Cloud Platform Security Architecture

    Deep expertise in designing, securing, and operating cloud infrastructure using GCP, AWS, or Alibaba Cloud. Understanding of cloud-native security controls, network security, compute isolation, and secrets management.

  • Kubernetes and Container Security

    Experience with container orchestration platforms like Kubernetes, including container security best practices, image scanning, runtime security, and Kubernetes-native security controls (RBAC, network policies, pod security policies).

  • Identity and Access Management (IAM)

    Hands-on experience implementing and managing identity platforms such as Okta or GSuite. Understanding of authentication mechanisms, authorization models, federation, and access control policies in cloud environments.

  • Network and Endpoint Security

    Knowledge of network security architectures, including VPN solutions, firewalls, network segmentation, and endpoint detection and response (EDR) tools. Understanding of how network telemetry can be used for threat detection and investigation.

  • Incident Response and Forensics

    Practical experience with digital forensics tools, log analysis, memory analysis, and incident response methodologies. Ability to preserve evidence, perform root cause analysis, and document findings for legal and operational purposes.

  • Programming Languages for Security Automation

    Proficiency in Python and/or Java/Kotlin for developing security automation scripts, detection rules, and tooling. Ability to write clean, maintainable code that integrates with existing security infrastructure and CI/CD pipelines.

Education

  • Bachelor's Degree in Cybersecurity, Computer Science, or Related Field (Preferred)

    Formal education in cybersecurity, computer science, information systems, or a closely related discipline. While not strictly required, this demonstrates foundational knowledge in security principles and software engineering concepts.

Experience

  • 8+ Years Security Engineering and Incident Response

    Extensive hands-on experience in security engineering roles, incident response, or threat detection within technology companies. Should demonstrate progressive responsibility in designing security systems, leading investigations, and implementing controls at scale.

  • Deep Cloud Platform Expertise

    In-depth knowledge of at least one major cloud platform's security model, services, and operational practices. Understanding of cloud-native security patterns, identity and access management (IAM), network segmentation, and data protection mechanisms is critical.

  • Software Development and Infrastructure Knowledge

    Strong understanding of modern software development practices, CI/CD tooling and pipelines, containerization, and infrastructure-as-code. Familiarity with deployment automation, version control systems, and build/release processes enables effective threat modeling and control design.

  • Attacker Tools, Techniques, and Procedures Expertise

    Comprehensive knowledge of common adversary tools, techniques, and procedures (TTPs), how attacks are executed, detection methodologies, and prevention strategies. Ability to perform high-quality investigations and provide actionable threat analysis to engineering teams.

  • Technical Communication and Stakeholder Management

    Proven ability to translate complex security and software concepts for diverse audiences, from C-level executives to non-technical business stakeholders. Experience communicating findings, recommendations, and risk assessments in business context.

Skills

Required

  • Threat Detection and Incident Response

    Expertise in developing detection strategies, investigating incidents, and performing root cause analysis. Ability to coordinate incident response activities and lead teams through complex security events with high quality investigations.

  • Cloud Security Architecture

    Strong capability in designing and securing cloud infrastructure across major platforms. Understanding of cloud service models, shared responsibility models, and cloud-native security controls.

  • Security Engineering and Control Design

    Ability to design, implement, and operationalize security controls at scale. Understanding of control frameworks, risk assessment methodologies, and continuous improvement processes.

  • Vulnerability Assessment and Remediation

    Expertise in identifying, analyzing, and remediating security vulnerabilities and misconfigurations. Proficiency with vulnerability scanning tools, penetration testing methodologies, and risk prioritization.

  • Forensic Analysis and Threat Hunting

    Advanced skills in collecting, analyzing, and interpreting forensic evidence from systems and networks. Ability to perform proactive threat hunting and develop detection signatures for emerging threats.

  • Security Infrastructure and Operations

    Experience building and maintaining security infrastructure including SIEM platforms, logging systems, alerting frameworks, and integration with operational technology. Understanding of security operations center (SOC) practices and procedures.

  • Cross-Functional Collaboration

    Ability to work effectively with product engineers, infrastructure teams, and business stakeholders. Strong communication skills and ability to influence security practices across the organization.

Preferred

  • Advanced Security Certifications

    Nice to have

    Industry-recognized certifications such as OSCP (Offensive Security Certified Professional), GIAC certifications (GCIH, GCIA, GCFE), or CEH (Certified Ethical Hacker) demonstrate advanced security expertise and commitment to continuous learning.

  • Published Security Research

    Nice to have

    Published articles, research papers, or technical blogs on cybersecurity topics. Demonstrates thought leadership, deep expertise, and ability to communicate complex security concepts to the industry.

  • DevOps and SRE Experience

    Nice to have

    Background in DevOps or Site Reliability Engineering (SRE) practices including infrastructure-as-code, observability, monitoring, and automation. Valuable for understanding production systems from an operational security perspective.

  • Splunk and Advanced SIEM Proficiency

    Nice to have

    Advanced skills with Splunk including custom SPL (Search Processing Language) development, dashboard creation, and knowledge object optimization. Experience with other SIEM platforms also valued.

  • Multi-Cloud Security Strategy

    Nice to have

    Experience designing security strategies across multiple cloud providers, including GCP, AWS, and Alibaba Cloud. Understanding of cloud provider-specific security services and compliance features.

  • Network Security Technologies

    Nice to have

    Hands-on experience with cloud-based VPN solutions, zero-trust network architecture, and modern network security appliances. Understanding of network protocol analysis and packet-level investigation.

  • Secure Coding and Application Security

    Nice to have

    Familiarity with secure coding practices, OWASP top vulnerabilities, and application security testing methodologies. Ability to partner with developers on secure design and threat modeling.

Compensation

Pay and benefits.

Base·USD 220,000 – 280,000

Full posting

Original listing.

About Airwallex

Airwallex is the AI-native financial operating system for a real-time, intelligent economy. More than 675,000 businesses, including McLaren Racing, Qantas, SHEIN, and TikTok, use us, directly or through our platform partners, to run their financial operations or build and monetize financial products of their own.

We started in Melbourne in 2015 to build the infrastructure global commerce runs on. We're the regulated backbone behind global payments: not by accident, but by design. A decade plus, 85+ licenses, and a financial infrastructure spanning North America, Europe, the Middle East, and Asia-Pacific.

We're co-headquartered in San Francisco and Singapore, with more than 2,700 people across 27 offices. We hire builders with founder-level energy, people who move fast with good judgment, dig in with real curiosity, and make calls from first principles rather than waiting to be told what to do. Read our operating principles to see it in full.

 

About the team

Airwallex’s Information Security team partners closely with engineering, IT, and other stakeholders to protect our systems, data, and employees while enabling the business to move quickly. The team helps build and maintain strong security practices across the company—from secure product and infrastructure design to risk reduction, incident response, audits, and compliance—so security is built into how we operate, not treated as a blocker.

What you'll do

As a Staff Product Security Engineer at Airwallex, you will be a trusted member of the Information Security team and work closely with Infrastructure, Product and Engineering teams across the business.

Reporting directly to the Product Security Engineering Manager, this role will see you being a critical part of Airwallex, helping to identify, protect, detect, respond and recover the organisation from cybersecurity threats.

This is a dynamic and hands-on role that requires experience in designing, developing and managing infrastructure projects, processes and standards related to the security of our networks, systems and applications.

This role is based in San Francisco, or Sydney or Melbourne

Responsibilities:

  • Create and build security controls that strengthen Airwallex’s ability to scale securely.

  • Design and deliver security improvements across applications, software, and services.

  • Develop and operationalise detection strategies and response workflows that improve the speed and effectiveness of incident response.

  • Build and enhance secure systems through strong integration, testing, operations, and maintenance practices.

  • Leverage and analyse endpoint, network, and cloud telemetry to identify, investigate, and mitigate threats.

  • Design, implement, and maintain cybersecurity infrastructure that improves resilience across the Airwallex environment.

  • Investigate, contain, and respond to cybersecurity incidents to reduce risk and strengthen defensive capability.

  • Assess and improve system and network security by identifying vulnerabilities, configuration issues, and remediation opportunities.

  • Collect and analyse threat intelligence and forensic evidence to better understand, track, and disrupt threats.

  • Conduct and support defensive operations, tactical forensics, and threat hunting to strengthen security outcomes.

  • Partner with teams across Airwallex to embed security into new and existing applications, software, and services and drive continuous improvement.

Who you are

We’re looking for people who meet the minimum qualifications for this role. The preferred qualifications are great to have, but are not mandatory.

Minimum qualifications:

  • 8+ years working in a security engineering or incident response role within a tech company

  • In depth expertise with at least one major cloud platform

  • Strong knowledge of common software development tools and infrastructure, including CI/CD tooling and pipelines

  • Comprehensive understanding of common attacker tools and techniques, how they can be detected and prevented, and ability to respond to incidents with high depth and quality of investigation

  • Strong communication skills with the ability to explain technical security and software concepts to a non-technical audience

  • A passion for solving the complex challenges of high-growth startups

  • Self motivation and drive to learn new skills, or dive deeper into existing skills

Preferred qualifications:

  • Bachelor's degree in Cybersecurity, Computer Science or similar

  • Recognised training or cybersecurity certifications (eg OSCP, GIAC, CEH)

  • Strong experience with Splunk and other common security monitoring tools

  • Past DevOps/SRE experience with Kubernetes

  • Experience with GCP or Alibaba Cloud (with or without certification)

  • Experience with Okta, GSuite, and cloud-based VPN services

  • Experience with Python, Java/Kotlin

  • Published articles, journals or blogs related to cybersecurity

Applicant Safety Policy: Fraud and Third-Party Recruiters

To protect you from recruitment scams, please be aware that Airwallex will not ask for bank details, sensitive ID numbers (i.e. passport), or any form of payment during the application or interview process. All official communication will come from an @airwallex.com email address. Please apply only through careers.airwallex.com or our official LinkedIn page.

Airwallex does not accept unsolicited resumes from search firms/recruiters. Airwallex will not pay any fees to search firms/recruiters if a candidate is submitted by a search firm/recruiter unless an agreement has been entered into with respect to specific open position(s). Search firms/recruiters submitting resumes to Airwallex on an unsolicited basis shall be deemed to accept this condition, regardless of any other provision to the contrary.

Equal opportunity

Airwallex is proud to be an equal opportunity employer. We value diversity and anyone seeking employment at Airwallex is considered based on merit, qualifications, competence and talent. We don’t regard color, religion, race, national origin, sexual orientation, ancestry, citizenship, sex, marital or family status, disability, gender, or any other legally protected status when making our hiring decisions. If you have a disability or special need that requires accommodation, please let us know.

Apply for this position

Redirects to Airwallex's application page.

Other roles

More at Airwallex.

View all 103 roles