Staff Engineer, Security & Compliance

About interface.ai interface.ai is the agentic AI platform for financial services — bringing conversational and agentic AI to the credit unions and community banks that serve everyday Americans. We're not a lab, we're not a demo company, and we're not burning runway on hypotheticals. We are in production, generating real revenue, and on a mission that matters: making intelligent financial services available to the millions of people who've never had a private banker. More than 100 banks and credit unions run on interface.ai , reaching over 10 million people. Many products are live today; the biggest bets — an AI-first contact center and an AI-native consumer banking experience — are what comes next. Backed by $30M in Series A funding and already cash-flow positive, we're at the inflection point: a proven product, paying customers, and a profitable business rebuilding itself as an AI-native company to lead a world where agents, not software, do the work. The Role Security and compliance are the foundation that lets interface.ai operate inside the regulated core of banking. We're looking for a hands-on Staff Engineer to own security and compliance for the platform — the person who sets the standards every domain builds to and keeps millions of members' data safe. This is a cross-pillar role. Rather than owning a single product area, you serve every domain and raise the whole organization's security and compliance ceiling. You partner with the CTO and with each domain's engineers, going deep wherever the hardest problem is and bringing the rest of the org up to the bar you set. It's a builder's seat, not a policy-only one. You'll write code, design controls, and automate the unglamorous parts of compliance so a fast-moving team can ship safely in a regulated environment. What You'll Own • The platform's security and compliance posture — SOC 2, PCI, and HIPAA — and the controls and evidence that keep them audit-ready. • PII handling and tenant separation — how sensitive member data is protected, isolated, and governed across a multi-institution platform. • The standards every domain builds to, plus the audit and assurance behind external and customer security reviews. • Data security for AI systems — keeping agentic and conversational AI safe when it authenticates members and takes real action in financial systems. • Compliance automation — replacing manual, point-in-time checks with continuous, engineered controls so the company can move fast without cutting corners. What We're Looking For • A senior-most individual contributor (Staff level) with deep security and/or compliance experience in regulated or financial environments — and still very much in the code. • Real ownership of SOC 2, PCI, or HIPAA programs — you've built and run the controls, not just read the framework, and you can move from policy to implementation without a translation layer. • Strong instincts for data security, encryption, PII handling, and tenant isolation at scale. • Data security for AI systems — you understand the new surface area that agentic and conversational AI introduces and how to secure it. • A bias toward automation — you'd rather engineer a continuous control than maintain a spreadsheet, and you've built compliance tooling before. • Extreme AI fluency — you use frontier AI tools daily and have rebuilt your workflow around them; first-principles problem-solving and high learning velocity. • BS/BA in Computer Science required; MS or PhD a strong plus. San Francisco-based and committed to working onsite. H1B transfers welcome. Bonus Points • Security or compliance leadership at a bank, fintech, or other heavily regulated platform. • Hands-on experience securing AI/ML or LLM-based systems in production. • Built compliance-automation tooling or evidence pipelines from scratch. • Relevant certifications (CISSP, CISM, or similar) — useful, but the build track record matters more. • Published writing, conference talks, or open-source work in security engineering or applied AI safety. What This Role Is — And Isn't This is a builder's seat, not a policy-only or pure-GRC role. You'll be in the code and the architecture, designing controls and automating them — the person who makes security and compliance real across the platform, with the authority to set the bar and the credibility to be trusted with it. It's not a role for someone who wants to write policy and hand it off, or who needs a large team to manage. As a cross-pillar role you serve every domain, owning the hardest security and compliance problems end-to-end. If that mandate at a profitable, fast-moving AI company is the leverage point you've been looking for, we want to talk. Benefits • 100% paid health, dental & vision care • 401(k) & financial wellness perks • Discretionary PTO + paid parental leave • Mental health, wellness & family benefits • A mission-driven team shaping the future of banking Why interface.ai Series A · $30M raised · Cash-flow positive — we're not b