Employer Job Description
From Rho's posting. “We” and “our” refer to the employer.
About Us
Rho is the modern banking platform built for the AI era. Startups and growth-stage companies can open accounts in minutes, issue cards, manage expenses, pay bills, and close the books – all in one connected platform backed by real human support.
About Us
Rho is on a mission to make finance frictionless for organizations. Our team and technology power high-performing companies with an all-in-one, end-to-end finance platform that lets organizations safely manage cash and spending across commercial-grade banking, corporate cards, treasury management, expense management, accounts payable, and more.
Our customers run their banking, cards, and payments through Rho. We are splitting a large Python monolith into Go and Python services on GCP, and shipping a public API, agents, and MCP surfaces. Security is part of the product.
The Team
Security at Rho is small: a VCISO, one security engineer in Poland, and the engineers who ship. You will be the first US security engineer. We plan to grow this into a team over the next six months, and you will help pick who.
The Role
Hands-on. You write production code most days. You own product and platform security, and you own finding queues and incident response until we hire for detection and response.
What you'll do
- Product Security
- Threat model new systems and review designs with the teams that own them before they ship.
- Build the paved road: secure defaults, guardrails in CI, dependency and supply chain checks, so the safe way is the easy way.
- Own the vulnerability lifecycle: triage findings from Pensar, Semgrep, CodeQL, Dependabot, pentests, and inbound researcher reports; hold the SLAs; write the fix or get it written; track remediation to zero. Stand up our vulnerability disclosure program.
- Platform Security
- Harden GCP and GKE: least-privilege IAM, workload identity, secrets, network policy, environment separation, all in Terraform.
- Secure our LLM, agent, and MCP surfaces: guardrails, sandboxes, agents as identities with scoped access, prompt injection detection.
- Detection & Response
- Own detections in our SIEM, tune signal to noise, keep the runbooks current, stand up on the call rotation, and lead incidents end to end: triage, contain, investigate, remediate, post-mortem.
- Run tabletop exercises and hunt for what detections miss.
What we're looking for
- 6+ years in security engineering, or software engineering with a security focus. You ship code and tools, not only findings.
- Depth in one of product security, cloud and platform security, or detection and response, and working knowledge of the other two.
- Comfortable changing production and owning the outcome. Python or Go, Kubernetes, Terraform, one major cloud.
- You can triage competing risks and trade security against velocity without slowing the team down.
- Clear writer: design reviews, runbooks and incident reports engineers actually read.
- NICE TO HAVE
- Fintech, payments or another regulated industry. PCI DSS or SOC 2 evidence work.
- Bug bounty, red team, CVEs, talks, or open source.
- Hands-on AI security: guardrails, agent identities, prompt injection.
About this listing
LAYIQ is an independent job-discovery service. This listing does not imply a partnership with or endorsement by the employer. Review the original posting for current details and availability.
Employer posted:
Listing check
- Employer posted
- · 3 days ago
- Status
- Listed as a current opening
- Apply goes to
- Ashby, the employer's hiring system
How to spot a ghost jobGhost Job Checker: check another job link
The checker shows whether the employer still lists a job.