Security Engineer, Business Continuity & Risk

Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block.

The Role

Square Financial Services, Inc. (SFS) is Block’s bank. We opened in March 2021 and provide lending and FDIC-insured deposit products to individuals and small businesses on a nationwide basis.

SFS Risk Management is scaling vendor security, third party risk, and business continuity through innovation. Our Risk team designs and promotes the frameworks, standards, and oversight that elevates security considerations among our vendors, simplifies our regulatory obligations, and ensures resilience in our business operations. The team also operates the agent-first platforms that turn those frameworks into running systems.

Most of governance is a data problem. The risk, control, and asset information needed to answer "are we secure and compliant?" is dispersed across dozens of systems: Security Engineers treat that as an engineering problem. You'll build the data pipelines, integrations, and agentic AI workflows that turn manual governance processes into products that run continuously, produce measurable results, and hold up to audit end to end.

You Will

Own and operationalize a SFS third-party risk management and business continuity program program.

Define the technical approach for ambiguous, cross-team problem spaces. This is an early-stage program, and you will frame problems as often as you solve them.

Build and operate the pipelines and integrations that aggregate, normalize, and join risk, control, and asset signals from systems of record across Block and SFS, including source control, the service registry, identity, ticketing, and data platforms.

Translate standards and compliance requirements into policy-as-code: enforceable, testable rules that run continuously. For example, "every production service has an accountable owner" becomes a versioned, tested check instead of a quarterly spreadsheet.

Design agentic AI workflows that pair LLM reasoning with deterministic, auditable decision layers for evidence analysis, control monitoring, classification, and assessment.

Automate evidence collection and continuous control monitoring to replace point-in-time audit preparation.

Partner with Security, Procurement, Resilience and Engineering teams to find the manual processes most worth turning into a product.

Contribute to technical design discussions, evaluating the security and reliability properties of the platform itself.

You Have

Third-party risk management and business continuity experience.

4+ years building production software in backend, platform, data, or software engineering

Multi-year ownership of a production system, including on-call, SLOs, and the maintenance work that starts after launch

Proficiency with at least one of Python, Kotlin, Java, or Go, and comfort reading unfamiliar codebases

Hands-on experience building with LLMs (prompting, tool use, agents, or LLM-backed features) and opinions about where model judgment belongs and where it doesn't. Judgment matters more here than volume

Experience with integration patterns: REST APIs, webhooks, authentication flows, event-driven architectures

Experience pulling, normalizing, and joining data from multiple imperfect sources, and handling the edge cases gracefully

Experience defining technical direction where the problem was ambiguous, and carrying it across team boundaries

Attention to d