Collections today works like an emergency room. The doctors carry too many patients, everyone arrives at their worst moment, and nobody has their chart. We're making it primary care. January personalizes interactions and optimizes decisions across every stage of consumer credit. We started in the hardest, most broken stage, because if it works there it works anywhere.

Most consumers want to pay what they owe. They want a way out, not a break. We've serviced over $20 billion in debt across more than 20 million consumers. We see more people with charged-off loans each year than all but the top five US banks. Those consumers rate us about 50% higher than the banks that lent them the money. Creditors net over 30% more because we collect more and charge less.

Most AI strips the human out of the work. We use it to make someone's hardest financial moment more human. The more human we make it, the more people recover. Now we're moving upstream, catching people before they default and building across every stage of the consumer credit lifecycle. The consumer in collections today is the consumer who gets approved tomorrow.

About the Role

As our first in-house Senior Security Engineer, you'll own the question every bank asks before it trusts us with its borrowers: who can reach this data, and how do you know? You'll set the standard for identity and access control across a platform that handles regulated financial data for banks, credit unions, and fintech lenders, in an environment where AI agents work alongside engineers. The work decides whether security is the reason a Tier-1 bank signs, or the reason it doesn't.

You will:

Own identity and access control across AWS (IAM, Identity Center), Okta, and the data tier (Postgres, Snowflake): tenant isolation for regulated data, least-privilege service identities, and access patterns that hold up to bank-grade review.

Harden the platform with the DevX/SRE team: Terraform reviews, CI/CD supply-chain controls, secrets management, and the guardrails for AI coding agents in the development workflow.

Make compliance a byproduct of good engineering. We're mid-flight on PCI DSS Level 1 and SOC 2 Type II. You'll build controls that generate their own evidence instead of quarterly scrambles.

Be the technical authority on client security reviews. Bank and fintech clients send us due diligence questionnaires. You make sure our answers are accurate, defensible, and fast, because they gate revenue.

Move the function from reactive to proactive: a vulnerability management program, a roadmap engineering can plan against, and written trade-offs that let teams decide without you in the room.

Set technical direction for a function that today runs on two full-time security contractors plus an IT lead. You'll report to the Engineering Manager for DevX & Security.

What We Need

Technical excellence in identity and infrastructure security. You've designed access models and tenant isolation for sensitive data in a cloud environment, and you reason in blast radius: what a leaked credential actually reaches, and where the boundary is enforced.

Ownership. You've been the person who built the security foundation somewhere, not the person who inherited it. You find the problem nobody owns and drive it without being asked.

Prioritization under uncertainty. You triage by exploitability and impact, not severity labels. You can name what you're not doing this week and defend it later.

Truth-seeking. You verify claims instead of accepting them, own it when you're wrong, and answer a client questionnaire honestly even when the honest answer is a gap.

Influence without authority. You make security the easy path for engineers and translate trade-offs into language a PM or an executive acts on.

Communication. You write clearly. Your assessments, incident summaries, and questionnaire responses can be forwarded as-is.

4+ years in security engineering, with hands-on depth in AWS, infrastructure-as-code, and Python. Experience with SOC 2, PCI DSS, or bank security standards is a plus: enough to design against them, not to run the program.