Location: San Francisco, CA (On-site, 5 days in-office) Salary: $190K–$250K base + competitive equity (higher for exceptional candidates) Visa: Open to visa transfers (e.g. OPT, H1B transfers) About this role We are looking for a Founding Security Lead with 4-8 years of experience to own and evolve the application security program at a fast-growing AI-native fintech startup. You'll be a "super IC" – someone who thrives doing hands-on security work while naturally growing into technical leadership. This role is ideal for someone with a strong application security background who is passionate about securing AI agents and agentic workflows in a highly regulated banking environment. You'll join an existing security foundation and take it to the next level as the company scales from Series A through its next phase of growth. What you will be doing • Owning and maturing the application security program – building security tooling, processes, and secure SDLC practices that integrate naturally into how engineers ship code • Securing the AI agent execution surface – partnering with engineering to establish robust security architecture for agentic workflows, ensuring data privacy and mitigating AI-specific vulnerabilities • Driving automation of security processes – building detection pipelines, automating vulnerability management, and reducing manual security overhead • Leading incident response – acting as primary incident commander and turning every event into systemic improvements • Supporting compliance and customer trust initiatives – contributing to SOC 2, ISO 27001, and bank-driven security requirements About Casca Casca is building AGI for banking, replacing decades-old legacy systems with AI-native technology that automates 90% of manual work. Founded 2023 by banking and ML experts from Stanford; backed by Peterson Ventures, Y Combinator, The Sarah Smith Fund and Clocktower Technology Ventures. 45 employees, $33M total funding. www.cascading.ai • 4-8 years of experience as an application security engineer dealing with rapid growth • Strong application security background; passion for securing AI agents and agentic workflows • Tech stack: TypeScript, JavaScript, AWS, GCP, DevSecOps, Secure SDLC, Threat Modeling, Application Security, IAM, SOC 2, ISO 27001, AI/LLM Security