Role Summary

The Principal Information Security Engineer leads cybersecurity operations and defense across all Self products and infrastructure. This role is instrumental in protecting customer data, ensuring compliance with SOC 2 and PCI requirements, and partnering closely with engineering and IT teams to detect, investigate, and respond to security threats. The ideal candidate brings deep expertise in security operations, threat detection, and incident response, along with hands-on experience building and evolving effective security capabilities.

What You Will Do

• Own end-to-end cybersecurity operations, including threat detection, incident response, and vulnerability management across all Self products and infrastructure
• Build, tune, and maintain detection capabilities within a SIEM platform to identify threats, anomalies, and policy violations
• Operate and optimize endpoint detection and response (EDR) solutions, including alert triage, threat hunting, and containment
• Manage cloud security posture, including misconfiguration identification, risk prioritization, and remediation tracking
• Administer and optimize secure access and web security platforms, including data loss prevention policy enforcement, shadow IT visibility, and web threat protection
• Design, manage, and optimize network security controls and cloud-native networking to enforce zero-trust principles and secure perimeter defenses.
• Lead incident response efforts, from detection through containment, eradication, and post-incident review
• Conduct proactive threat hunting across endpoint, network, and cloud environments
• Propose and implement scalable security processes that improve operational efficiency and reduce manual effort
• Partner with engineering and infrastructure teams to remediate critical security findings and reduce attack surface
• Lead and perform third-party vendor security reviews and risk assessments
• Support SOC 2 and PCI compliance efforts, including audit preparation and evidence collection
• Identify security risks across the environment and recommend mitigation strategies
• Monitor emerging cybersecurity threats and translate them into actionable detection and prevention controls

Who You Are

• 12+ years of experience in cybersecurity, security operations, or information security engineering
• Hands-on experience with security monitoring and log analysis platforms for detection engineering
• Proficiency with endpoint detection and response tools for threat detection and investigation
• Experience using cloud security posture management tools for cloud security visibility and risk remediation
• Hands-on experience with CASB/SSE platforms for data loss prevention, shadow IT visibility, and secure web access
• Solid understanding of network security, cloud security, and identity and access management
• Experience with vulnerability management programs and remediation workflows
• Strong understanding of adversary tactics, techniques, and procedures (TTPs) and how they apply to modern environments
• Strong background in incident response, including investigation, containment, and root cause analysis
• Experience supporting or operating within SOC 2 and PCI compliance environments
• Ability to partner effectively with engineering and infrastructure teams to drive security outcomes
• Strong risk assessment, prioritization, and communication skills

Preferred Qualifications

• Experience performing third-party vendor security assessments
• Familiarity with cloud-native architectures and container security
• Prior experience in fintech, regulated industries, or environments handling sensitive customer data
• Experience with threat intelligence platforms and integrating feeds into detection workflows
• Security certifications such as CISSP, CISM, GCIA, GCIH, GCED, or equivalent experience

Base salary range: $ 180,000-210,000 annually.  Individual pay is based on factors unique to each candidate, including skill set, experience, and other job-related reasons.

About Self

Self Financial is a fintech on a mission to expand access to credit for the more than 100 million U.S. consumers who are underserved by traditional lenders. Our product suite — the Credit Builder Account, Self Credit Card, and Self Cash — helps customers establish and strengthen credit while building savings. We have roughly 200 employees, profitable on a path to scale, and in the middle of a strategic evolution: becoming a data and ML/AI company that originates credit intelligently and funds receivables efficiently through the capital markets.

The Chief Credit Officer role sits at the center of that evolution.

The Opportunity

Self serves near-prime and credit-building consumers — a segment where traditional bureau-based underwriting is blunt, where thin files are the norm, and where the spread between a good decision and a bad one is enormous. We have more than a decade of proprietary performance data across our products, a captive view of customer behavior that very few lenders have, and the engineering and data science talent to build something genuinely differentiated.

We are hiring a CCO to build Self into an ML/AI-driven credit decisioning company. This is not a role for someone who wants to manage an existing scorecard. It is a role for someone who believes — and can prove — that modern modeling applied to the credit-building segment can compound into a durable advantage, and who has the technical depth and organizational credibility to make it happen inside a regulated fintech.

Year-One Mandate

In the first twelve months, the CCO will:

• Stand up a modern, ML-driven credit decisioning stack across the Self Credit Card — moving us from heuristic and legacy scorecard logic to models that learn from our proprietary data.
• Partner with the CFO and capital markets team to translate credit performance and model transparency into terms that unlock more efficient receivables funding — lower advance rates, tighter spreads, broader investor base.
• Build the governance, documentation, and model risk management discipline required to run ML credit models in a CFPB-regulated environment, including fair lending testing, adverse action explainability, and ongoing monitoring.
• Lead, develop, and selectively upgrade the existing credit team — roughly 12 people across risk, analytics, and collections — and establish the operating rhythm that connects credit strategy to product, finance, and the board.

Ongoing Responsibilities

Credit Strategy & ML/AI Decisioning

• Own the end-to-end credit risk strategy across all Self products — acquisition underwriting, line assignment, pricing, account management, and collections.
• Drive the design, training, validation, and deployment of ML-based credit models, in partnership with our data science and engineering teams. Set the technical bar for what 'good' looks like.
• Use our proprietary data — payment behavior, account trajectory, cross-product signals — as the core asset in a decisioning system that competitors cannot replicate from bureau data alone.
• Develop loss forecasting and portfolio analytics that are trusted by the board, auditors, and capital partners.

Portfolio & Capital Markets

• Manage the performance of a multi-product receivables portfolio spanning credit-building and near-prime segments.
• Work directly with the CFO and structured finance team on warehouse facilities, forward flow arrangements, and securitization — translating credit performance into capital markets terms and vice versa.
• Serve as a credible voice with lenders, rating agencies, and investors on model methodology, portfolio construction, and loss expectations.

Policy, Governance & Fair Lending

• Own credit policy end to end, with documentation and controls that meet the standard expected of a regulated consumer lender.
• Ensure compliance with CFPB expectations, fair lending requirements, ECOA, FCRA, UDAAP, and state-level consumer credit regulations.
• Establish a model risk management framework — including explainability, disparate impact testing, and challenger model discipline — that lets us move fast with ML without compromising on rigor.

Collections & Customer Outcomes

• Direct collections strategy with the dual objective of minimizing losses and producing good outcomes for customers who are, by design, early in their credit journey.
• Manage relationships with third-party servicers, bureaus, data providers, and decisioning vendors.

Leadership & Cross-Functional Partnership

• Lead the existing credit organization. Raise the bar on analytical depth, technical sophistication, and execution speed.
• Partner closely with Product, Engineering, Data Science, Finance, Compliance, and Legal. Credit at Self is not a gatekeeping function — it is a product input.
• Report regularly to the CEO and board on portfolio health, model performance, and strategic initiatives.

What We're Looking For

Required

• 10+ years in consumer credit risk, with meaningful time in fintech or direct-to-consumer lending.
• Direct, hands-on experience building and deploying ML/AI-based credit decisioning models — not just sponsoring them. You should be able to go deep on model architecture, feature engineering, validation approach, and fair lending testing.
• Fluency in capital markets and structured finance as they apply to consumer receivables: warehouse facilities, securitization, forward flow, rating agency interactions. You understand how credit performance translates into financing cost.
• Proven track record in the near-prime, subprime, or credit-building segments. You understand the customer, the unit economics, and the regulatory attention these segments attract.
• Deep working knowledge of CFPB, ECOA, FCRA, Fair Lending, and UDAAP as they apply to algorithmic underwriting.
• Strong leadership presence with the ability to operate as a peer to the CEO, CFO, and board — and the credibility to represent Self externally with regulators, lenders, and investors.

Strongly Preferred

• Experience leading a credit function through a strategic transition — portfolio remediation, platform modernization, or a shift in funding strategy.
• Prior experience at a company that sits at the intersection of analytics and lending — for example, a credit card company, a credit-focused fintech, or a bank's digital consumer lending arm.

Why Self, Why Now

Self is at an inflection point. The portfolio is large enough to matter, the data is proprietary, the product surface is expanding, and the capital markets opportunity is real. The CCO who joins now will set the credit foundation for the next phase of the company — and will own, end to end, the single function most responsible for whether that phase succeeds.

If you have spent a career waiting for a role where modern ML credit modeling, a mission-aligned customer base, and direct capital markets leverage come together in one seat — this is that role.

This is an executive level position and individual pay is based on factors unique to each candidate, including skill set, experience, and other job-related reasons.

Role Summary

The Senior Information Security Engineer is responsible for owning application security across all Self products. This role plays a critical part in protecting customer data, ensuring compliance with SOC 2 and PCI requirements, and partnering closely with engineering teams to identify, prioritize, and remediate security risks throughout the software development lifecycle. 

What you will do:

• Own end-to-end application security for all Self products
• Conduct and manage vulnerability scanning, triage, and remediation tracking using security tools (e.g., SAST)
• Partner closely with engineering and product teams to remediate critical security findings
• Lead and perform third-party vendor security reviews and risk assessments
• Support SOC 2 and PCI compliance efforts, including audit preparation and evidence collection
• Identify application-level security risks and recommend mitigation strategies
• Help embed secure-by-design practices into product development processes
• Monitor emerging application security threats and recommend appropriate controls

Who you are: 

• Strong experience in application security, product security, or software security engineering
• Experience with application security scanning using GitLab SAST
• Hands-on experience with vulnerability management tools and remediation workflows
• Knowledge of secure software development practices and common application vulnerabilities 
• Experience supporting or operating within SOC 2 and PCI compliance environments
• Ability to partner effectively with engineering teams to drive security outcomes
• Strong risk assessment, prioritization, and communication skills

Preferred Qualifications

• Experience performing third-party vendor security assessments
• Familiarity with cloud-native application architectures
• Prior experience in fintech, regulated industries, or environments handling sensitive customer data
• Security certifications (e.g., CISSP, CSSLP, GWAPT) or equivalent experience

Base salary range: $ 100,000-148,000 annually.  Individual pay is based on factors unique to each candidate, including skill set, experience, and other job-related reasons.