Who we are

Dave is on a mission to build products that level the financial playing field™. We believe in financial opportunity for everyday Americans—because we all deserve a banking system that works for us, not against us. Our members hustle to make money work for them. They don’t need a hero. They need a system that isn’t designed to hold them down. That’s where we come in.

Why this role matters

Security at Dave protects more than infrastructure—it protects trust. As Lead Security Engineer, you’ll be the technical lead for DFIR (Digital Forensics and Incident Response). You’ll own and evolve our detection and response program as we grow—and work on systems that protect millions of members.

Over the years, we’ve made incremental DFIR improvements. But with our scale and user base today, we need a programmatic approach—grounded in clear triage, smart automation, and tooling that scales. You’ll drive that transformation.

You won’t be starting from zero—we have qualified tools (e.g., CrowdStrike, Upwinds, Chronicle) and logging pipelines in place. But digital forensics is early-stage and currently vendor-reliant. You’ll lead the shift toward in-house capability, maturity, and clarity across the stack.

What you’ll tackle

Lead DFIR at Dave. Own the vision and execution for digital forensics and incident response across cloud, endpoint, and SaaS.
Build what matters. Establish core forensics workflows, evolve our SIEM, and mature our ability to respond—not just react.
Scale detection. Own detection off of CrowdStrike, tune Chronicle outputs, and build noise-resistant alert handling.
Drive coverage. Partner on Upwinds CDR deployments, increasing breadth and depth of coverage across infra and SaaS.
Automate and teach. Write tooling (Python, Terraform) that outlasts incidents—and empower others to respond, even without deep DFIR background.
Triage, clarified. Lead efforts to define what clarity looks like when incidents hit—so response is calm, fast, and confident.

What success looks like

In your first year, you’ll:

Stand up a reliable in-house digital forensics capability
Formalize alert pipelines and triage processes across core tools (CrowdStrike, Chronicle, Upwinds, etc.)
Deliver real reductions in MTTD and MTTR—while increasing team trust in our alerts
Proactively strengthen detection through vulnerability triage, threat modeling, and purple teaming
Be seen as the driver of DFIR strategy and execution—not just the responder

What’s ahead

You’ll lead some of the most critical security projects we’ve ever taken on:

Standing up new detection and response tooling
Replacing vendor forensics with in-house pipelines
Defining what “clarity of triage” means in a high-growth org
Building systems that protect members and enable engineers—not