Location: San Francisco, CA (On-site, 5 days in-office)
Salary: $190K–$250K base + competitive equity (higher for exceptional candidates)
Visa: Open to visa transfers (e.g. OPT, H1B transfers)
About this role
We are looking for a Founding Security Lead with 4-8 years of experience to own and evolve the application security program at a fast-growing AI-native fintech startup. You'll be a "super IC" – someone who thrives doing hands-on security work while naturally growing into technical leadership. This role is ideal for someone with a strong application security background who is passionate about securing AI agents and agentic workflows in a highly regulated banking environment. You'll join an existing security foundation and take it to the next level as the company scales from Series A through its next phase of growth.
What you will be doing
Owning and maturing the application security program – building security tooling, processes, and secure SDLC practices that integrate naturally into how engineers ship code
Securing the AI agent execution surface – partnering with engineering to establish robust security architecture for agentic workflows, ensuring data privacy and mitigating AI-specific vulnerabilities
Driving automation of security processes – building detection pipelines, automating vulnerability management, and reducing manual security overhead
Leading incident response – acting as primary incident commander and turning every event into systemic improvements
Supporting compliance and customer trust initiatives – contributing to SOC 2, ISO 27001, and bank-driven security requirements
About Casca
Casca is building AGI for banking, replacing decades-old legacy systems with AI-native technology that automates 90% of manual work. Founded 2023 by banking and ML experts from Stanford; backed by Peterson Ventures, Y Combinator, The Sarah Smith Fund and Clocktower Technology Ventures. 45 employees, $33M total funding. www.cascading.ai
4-8 years of experience as an application security engineer dealing with rapid growth
Strong application security background; passion for securing AI agents and agentic workflows
Tech stack: TypeScript, JavaScript, AWS, GCP, DevSecOps, Secure SDLC, Threat Modeling, Application Security, IAM, SOC 2, ISO 27001, AI/LLM Security