Your role

As a Security Engineer, you will own the security of the systems financial institutions trust with sensitive client data and regulated financial workflows: our applications, our cloud infrastructure and the engineering practices that produce them.

Saturn is a Series A, Y Combinator-backed company building the AI-native operating system for financial advice. Our platform combines a living data model of the client, AI agents that complete complex advice and operational workflows, and compliance logic embedded directly into how work is produced. That means real client data, real money movements and real regulatory consequences, all moving through systems that are still being built.

You will not operate as a gatekeeper or arrive at the end of a project to review it. You are expected to understand how systems actually work, identify where a failure or an attack would cause real harm, and help teams fix it at the right level. Your work is what allows Saturn to meet the security expectations of large financial institutions without slowing engineering down with process for its own sake.

The Team

Our engineers care deeply about craft, speed and quality. They include early and founding team members from companies including Rippling, Postman, Gojek, CRED and Slice.

You will work alongside product designers, backend engineers, AI engineers and domain experts with decades of experience in financial advice and compliance.

We are building a small, high calibre engineering organisation for people who want genuine ownership, difficult product problems and the opportunity to shape an important company while its foundations are still being formed.

What You’ll Work On

• Application and API security across Saturn’s web applications, backend services and integrations, including authentication, authorisation, session management and firm-level data separation
• AWS security, covering IAM, network controls, secrets, encryption and workload isolation
• Threat modelling and security review for new systems, financial workflows, external integrations and AI capabilities, joining projects early enough to change their design
• Vulnerability management end to end: discovery, prioritisation by real risk, remediation and verification across code, dependencies, cloud resources and employee systems
• Security tooling and automation, including checks built into CI/CD, so the same work is never done manually twice
• Detection and incident response, from logging and alerting through investigation and recovery, turning each incident into a lasting improvement to systems and controls
• AI security, including prompt injection, unsafe tool execution, retrieved data and sensitive information disclosure
• Evidence and assurance for SOC 2, enterprise security reviews and customer due diligence, plus the reusable security patterns engineering teams adopt as standard