DevSecOps Engineer

About Maxima

Nobody went into accounting to spend the first week of every month matching transactions by hand. Maxima was built so they don't have to. Our agents do the accounting work itself: journal entries, transaction matching, reconciliations, and flux analysis, continuously and with a full audit trail. Accountants review and approve. Nothing posts without a person signing off. We remove the grind, not the human.

Maxima is the agentic AI platform for enterprise accounting. Our three co-founders scaled finance at Rubrik from $5M ARR to a $15B NYSE IPO, built the reconciliation and billing systems behind Netflix's $32B in annual revenue, and built AI infrastructure serving two billion monthly users at Meta. We've raised $41M from Redpoint Ventures, Kleiner Perkins and Audacious Ventures, joined by former BlackLine executives and the CFOs of Rubrik and Vanta. To date we've processed more than $400B across 350M transactions at 100.00% accuracy, for customers including Scale AI, Rippling, Glean, Zendesk, Handshake, Zip, and Decagon.

We're early and moving fast. The playbook here gets written, not inherited, and the person closest to the work makes the call. We're looking for people who build from first principles and hold themselves accountable for what actually lands — people who'd rather build the category than join it. Everything you need to know is below.

The role

We are working on some of the hardest problems in enterprise automation, with an engineering team that includes staff-level talent from Robinhood, Glean, Google, Netflix, and Meta. The system handles high-volume financial data and complex accounting workflows, and every execution has to be accurate and reliable, because the output is a company's books.

You will own security across Maxima's software development lifecycle: CI/CD pipelines, cloud infrastructure on GCP, container and artifact hardening, secrets and key management, and the controls behind our SOC 1, SOC 2, and ISO 42001 compliance. Customers trust Maxima with their general ledger, and their auditors ask how we protect it. Your work is a large part of the answer.

It is a hands-on role in a full-stack environment, with a shift-left approach to security and a share of developer infrastructure work.

What you'll do

• Implement and manage DevSecOps practices across the SDLC with a shift-left approach to security

• Design and harden CI/CD pipelines such as GitHub Actions, with minimal permissions and OIDC with Workload Identity Federation for cloud deployments

• Integrate and enforce SAST, dependency scanning, and secret scanning (for example Trufflehog or GitGuardian) so builds fail on high-severity issues