About the role
About Us
Rho is the modern banking platform built for the AI era. Startups and growth-stage companies can open accounts in minutes, issue cards, manage expenses, pay bills, and close the books – all in one connected platform backed by real human support.
About Us
Rho is on a mission to make finance frictionless for organizations. Our team and technology power high-performing companies with an all-in-one, end-to-end finance platform that lets organizations safely manage cash and spending across commercial-grade banking, corporate cards, treasury management, expense management, accounts payable, and more.
Our customers run their banking, cards, and payments through Rho. We are splitting a large Python monolith into Go and Python services on GCP, and shipping a public API, agents, and MCP surfaces. Security is part of the product.
The Team
Security at Rho is small: a VCISO, one security engineer in Poland, and the engineers who ship. You will be the first US security engineer. We plan to grow this into a team over the next six months, and you will help pick who.
The Role
Hands-on. You write production code most days. You own product and platform security, and you own finding queues and incident response until we hire for detection and response.
What you'll do
Product Security
- Threat model new systems and review designs with the teams that own them before they ship.
- Build the paved road: secure defaults, guardrails in CI, dependency and supply chain checks, so the safe way is the easy way.
- Own the vulnerability lifecycle: triage findings from Pensar, Semgrep, CodeQL, Dependabot, pentests, and inbound researcher reports; hold the SLAs; write the fix or get it written; track remediation to zero. Stand up our vulnerability disclosure program.
Platform Security
- Harden GCP and GKE: least-privilege IAM, workload identity, secrets, network policy, environment separation, all in Terraform.
- Secure our LLM, agent, and MCP surfaces: guardrails, sandboxes, agents as identities with scoped access, prompt injection detection.