A1 Audio Engineer, Live Events

ABOUT BUREAU Bureau is a unified risk decisioning platform for Compliance, Fraud, and Transaction risks. Our platform is a single decision-making engine, powered by a 1 billion+ identity knowledge graph. Over 150 Banks, fintechs, retailers, and digital platforms use Bureau to verify identities faster and stop fraud earlier globally. Bureau has raised $50M+ from renowned Silicon Valley and global investors including Sorenson Capital and PayPal Ventures and is expanding rapidly from APAC to Americas, Europe, and beyond. WHY BUREAU? Bureau is building the infrastructure that makes digital identities and transactions safe and trustworthy for billions of people. The mission is big, the problems are complex, and the impact is real. We hire people who want that level of responsibility. People who move fast, build systems from scratch, and care deeply about turning strategy into execution. If you want predictability or narrow scope, this won't be your place. If you want to shape how a scaling global company operates—keep reading. ABOUT THE ROLE - INFORMATION SECURITY ENGINEER We are looking for a Security Engineer who can own both the hands-on technical security stack and our governance/compliance programs. What you’ll be doing In this role, you will: * Harden and monitor our cloud & container infrastructure (AWS/EKS, endpoints, network). * Run vulnerability management, security tooling and incident response. * Help maintain our ISMS and support audits (ISO 27001, SOC 2, RBI, DPDP, etc.). This is ideal for someone who doesn’t want to be only “checklist GRC” or only “pure blue-team”, but wants a blended role across security engineering + GRC.Key Responsibilities 1. Cloud & Infrastructure Security (Hands-on) * Work with DevOps to secure our AWS/EKS environment: * IAM hardening, security groups, VPC, KMS, S3, RDS, etc. * Review infra-as-code (Terraform/Helm) for security issues and misconfigurations. * Own or co-own key security tools: * Endpoint / EDR (e.g., CrowdStrike / SentinelOne), * Cloud security (CSPM / CNAPP, GuardDuty, Security Hub, WAF, etc.), * Container / runtime security where applicable. * Implement and maintain logging & monitoring for security events (CloudTrail, ALB/NLB logs, K8s logs, etc.), and integrate them with SIEM / alerting. 2. Vulnerability Management & Security Operations * Own the vulnerability management lifecycle: * Run periodic scans for cloud, endpoints, containers and apps. * Triage findings, prioritise based on risk, and drive closure with engineering. * Coordinate external pentests / bug bounties and track remediation. * Support incident response: * Help investigate alerts, gather evidence, and contribute to RCA and CAPA. * Maintain and update incident runbooks. 3. Governance, Risk & Compliance (ISMS, Audits, DPDP) * Maintain and enhance the Information Security Management System (ISMS): * Policies, procedures, SoA, risk register, control evidence and audit trails. * Support internal and external audits: ISO 27001, SOC 2, RBI/CERT-In, Data Protection. * Prepare and manage audit evidence, observations, closure reports and certification documentation. * Assist with risk assessments: * Maintain the risk register, risk treatment plans and residual risk reviews. * Conduct vendor security due diligence and maintain vendor security records (MSA, NDA, DPA, DPIA, etc.). * Support privacy & regulatory compliance operations (GDPR/DPDP basics: retention, consent, grievance logging). 4. Access, Asset & Control Assurance * Participate in and help automate access reviews, asset inventory checks, and configuration compliance checks. * Track control performance (vuln SLAs, access reviews, backup tests, etc.) and ensure gaps are documented and closed. * Maintain security awareness and training trackers (onboarding, annual refreshers, phishing simulations). What You’ll Bring * Bachelor’s degree in Computer Science, IT, Cybersecurity or related discipline. * ~4 years of experience in security engineering, cloud security, or GRC/compliance (any mix, but must be comfortable hands-on). * Good understanding of: * Security engineering fundamentals: Linux, networking, IAM, encryption, least privilege. * Cloud platforms (AWS preferred; GCP/Azure a plus) and their security services. * Core frameworks: ISO 27001, SOC 2, basic risk management and audit lifecycle. * Comfortable with: * Writing/debugging basic scripts (Bash/Python) for automation and data extraction. * Tools like Jira, Confluence, Excel/Sheets and at least one GRC / security platform (e.g., Scrut/Drata/Secureframe, etc.). * Strong documentation skills and ability to talk to both engineers and non-technical stakeholders. Preferred (Good to Have) / Willing to Learn * Cloud security certifications (e.g., AWS Security / AWS Cloud Practitioner). * ISO 27001:2022 Lead Auditor/Implementer, CompTIA Security+, ISC2 CC. * Experience with: * EDR/XDR tools, * CSPM/CNAPP (e.g., Wiz, Prisma, Defender for Cloud), * SIEM, WAF, runtime/container security (Falco, etc.). * Exposure to GDPR/DPDP or other data protection regimes. Who You Are * You enjoy both: * Getting your hands dirty in logs, configs and cloud consoles, and * Keeping things clean in policies, risk registers and audit trackers. * You’re structured and process-oriented, but still pragmatic and capable of shipping improvements. * You’re comfortable collaborating with DevOps, backend, data, HR and legal to get security actually implemented, not just written down. * You want to grow into either Security Engineering leadership (owning tools/architecture) or GRC leadership (owning audits and certifications) over the next few years. OUR CULTURE * We hire self-motivated people and get out of their way * We value performance, not hours worked * Speed, ownership, and impact matter most COMPENSATION * Competitive salary + potential equity * Health benefits, flexible PTO, learning budget

Who We Are: Alpaca is a US-headquartered self-clearing broker-dealer and brokerage infrastructure for stocks, ETFs, options, crypto, fixed income, 24/5 trading, and more. Our recent Series D funding round [https://alpaca.markets/blog/alpaca-raises-150-million-at-a-1-15b-valuation-to-build-the-global-standard-for-brokerage-infrastructure/] brought our total investment to over $320 million, fueling our ambitious vision. Amongst our subsidiaries, Alpaca is a licensed financial services company, serving hundreds of financial institutions across 40 countries with our institutional-grade APIs. This includes broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, totalling over 9 million brokerage accounts. Our global team is a diverse group of experienced engineers, traders, and brokerage professionals who are working to achieve our mission of opening financial services to everyone on the planet. We're deeply committed to open-source contributions and fostering a vibrant community, continuously enhancing our award-winning, developer-friendly API and the robust infrastructure behind it. Alpaca is proudly backed by top-tier global investors, including Portage Ventures, Spark Capital, Tribe Capital, Social Leverage, Horizons Ventures, Unbound, SBI Group, Derayah Financial, Elefund, and Y Combinator.   Our Team Members: We're a dynamic team of 380+ globally distributed members who thrive working from our favorite places around the world, with teammates spanning the USA, Canada, Japan, Hungary, Nigeria, Brazil, the UK, and beyond! We're searching for passionate individuals eager to contribute to Alpaca's rapid growth. If you align with our core values—Stay Curious, Have Empathy, and Be Accountable—and are ready to make a significant impact, we encourage you to apply. YOUR ROLE: Alpaca is seeking a Trade Surveillance Analyst to join the Financial Crimes Department and support the firm’s market-integrity, financial-crime, and compliance surveillance program. This role will be responsible for monitoring trading activity, reviewing alerts, investigating suspicious or potentially manipulative trading behavior, and escalating matters that may involve market abuse, fraud, insider trading, wash trading, spoofing, layering, front-running, information-barrier concerns, or other suspicious trading patterns. The analyst will use Surveyor by Trillium and Alpaca’s internal systems to conduct near real-time and post-trade reviews, identify anomalies, document investigative findings, and support internal escalations, regulatory inquiries, and matters that may require suspicious-activity reporting. The role combines strong investigative judgment, trade-surveillance expertise, AML & Fraud awareness, and the ability to operate in a fast-paced, technology-driven trading environment. THINGS YOU GET TO DO: * Development, review, and test trade-surveillance scenarios, alert logic, escalation procedures, and control documentation * Make sure procedures and processes are well documented, and distributed to all stakeholders. Ensuring updates are properly accounted for as needed but no less than once per year * Monitor trading activity using Surveyor and Alpaca’s internal systems to identify potential market abuse, suspicious trading, unusual order behavior, and other conduct risks * Review and investigate trade-surveillance alerts involving potential spoofing, layering, wash trading, front-running, insider trading, manipulative order activity, information-barrier issues, or other suspicious trading patterns * Analyze trading activity in the context of market events, client behavior, account activity, transaction patterns, and relevant internal information to determine whether activity is reasonable, unusual, or suspicious * Conduct real-time and post-trade reviews to detect anomalies, assess risk, and determine whether escalation is appropriate * Clearly document surveillance reviews, investigative steps, evidence reviewed, rationale, conclusions, and recommended next actions * Escalate suspicious or high-risk matters to AML leadership, Compliance, Legal, Risk, and other appropriate internal stakeholders * Coordinate with the AML Department on trading-related investigations, including matters that may require suspicious-activity review or SAR consideration * Support KYC/AML and transaction-monitoring processes by identifying trading behavior that may indicate financial-crime risk, account misuse, fraud, market manipulation, or other suspicious activity * Respond to internal escalations involving trading activity, account behavior, customer activity, or potential violations of firm policy * Assist with regulatory inquiries, audit requests, internal reviews, and other examinations related to trade surveillance, AML, and market-integrity controls * Partner with Compliance, Legal, Risk, Technology, Operations, and business stakeholders to strengthen Alpaca’s surveillance framework and improve investigation workflows * Identify emerging surveillance risks, suspicious-trading typologies, control gaps, and opportunities to improve the quality and effectiveness of the trade-surveillance program * Prepare clear summaries, metrics, and management reporting related to trade-surveillance activity, alert trends, escalations, and investigation outcomes * Maintain strong knowledge of relevant market-abuse risks, AML red flags, trading behaviors, and regulatory expectations applicable to Alpaca’s business WHO YOU ARE (MUST-HAVES): * 5+ years of experience in Fintech trade surveillance, AML investigations, transaction monitoring, financial-crime compliance, brokerage compliance, market surveillance, risk, investigations, or a related control function * Experience working at a broker-dealer, fintech, trading platform, exchange, introducing broker, clearing firm, market maker, proprietary trading firm, crypto trading or other regulated financial institution * Strong understanding of trading activity, order behavior, market structure, customer activity, and potential indicators of market manipulation or suspicious activity * Familiarity with market-abuse typologies, including spoofing, layering, wash trading, front-running, insider trading, unusual price or volume activity, and manipulative order behavior * Ability to review trading data, identify behavioral patterns, investigate exceptions, and form well-supported conclusions * Experience documenting investigations in a clear, concise, and audit-ready manner * Strong analytical skills, sound judgment, attention to detail, and ability to prioritize multiple reviews or investigations * High integrity, discretion, and ability to handle confidential information appropriately * Strong written and verbal communication skills, including the ability to explain complex trading activity to AML, Compliance, Legal, Risk, Technology, and business stakeholders * Ability to work independently while collaborating across teams in a fast-paced environment * FINRA Series 7 license  WHO YOU MIGHT BE (NICE-TO-HAVES): * Experience using Surveyor by Trillium for trade surveillance, alert review, investigation, or escalation workflows * FINRA Series 24   HOW WE TAKE CARE OF YOU: * Competitive Salary & Stock Options * Health Benefits * New Hire Home-Office Setup: One-time USD $500 * Monthly Stipend: USD $150 per month via a Brex Card Alpaca is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse workforce. Recruitment Privacy Policy [https://files.alpaca.markets/disclosures/AlpacaRecruitmentPrivacyPolicy.pdf]