⚡️ Founding Full Stack Software Engineer ⚡️

## tl;dr

We're rebuilding bank compliance as an engineering problem. Today, auditors sample 5% of a fintech's files by hand and write findings in spreadsheets. We run the actual math on 100% of them — every dispute, every statement, every adverse-action notice — with deterministic rules and LLM-as-judge evaluation. You'll be one of the first engineers, building the agents and pipelines that reperform a bank's compliance at population scale. If you've shipped real LLM systems and want them to do something that matters, let's talk.

## Why this exists

Before a fintech can issue a loan, send a statement, or resolve a dispute, its partner bank has to prove the whole operation followed the rules — Reg E, TILA, FCRA, SCRA, UDAAP, and dozens more. The way that's checked today hasn't changed in decades: consultants pull a small sample, eyeball it, and hope the other 95% looks the same.

It usually doesn't. On one Reg E engagement we reperformed the error-resolution math on 14,000+ disputes and surfaced timing and provisional-credit violations that no sample would have caught. On a TILA engagement we rebuilt daily balances and finance charges from raw platform data and found a systematic interest-method bug the bank had been disclosing incorrectly for months.

That's the wedge: compliance testing is a verification problem, and verification problems are engineering problems. We test everything, we show our work, and we hand banks evidence an examiner will accept.

## The founders

**Esty (CEO)** dropped out of NYU's CS program at 19 and taught herself security well enough to earn the CISSP and OSCP. She built AI-based security systems at Invoca and led R&D at Buggy before this, and she still approaches compliance the way she approached pentesting — assume the system is broken and go find where.

**Bivu (CTO)** spent a decade in ML engineering, including leading IVR fraud detection at Pindrop — a system that six of the ten largest U.S. banks now run in production.

Shiboleth started as a deepfake-audio-detection research project that ended up on stage at Black Hat and then in TechCrunch. The through-line we kept hitting: security had matured into a real engineering discipline with continuous monitoring and standards, and compliance — a bigger, more regulated market — had almost none of that. We started Shiboleth to close that gap.

## What you'll work on

* **Agentic reperformance.** Building agents that reconstruct what a statement, notice, or dispute resolution _should_ have been from raw data — recalculating minimum payments, interest, and finance charges, then comparing against what the consumer actually received. * **Context engineering for regulation.** Turning dense regulatory text and bank-specific test requirements into specifications an LLM-as-judge can apply consistently across populations of hundreds of thousands of records. * **Population-scale pipelines.** Ingestion, normalization, and PII redaction over messy SFTP/PGP feeds and warehouse data, feeding deterministic SQL rules and model-based evaluation. * **Evidence, not vibes.** The hard part isn't the verdict — it's assembling defensible, examiner-ready evidence for every one of those verdicts.

## Your first 90 days

* **Month 1:** Ship your first end-to-end rule suite for a live partner bank — owning it from raw data ingestion through evidence output, in production, with a real customer reading the results. * **Month 2:** Take ownership of a piece of core platform — likely the agentic reperformance layer or the LLM-as-judge evaluation harness — and improve its accuracy and consistency on a domain you hadn't seen before. * **Month 3:** Lead a new regulatory domain end-to-end (we're actively expanding into new test targets), proving the engine generalizes beyond what one person could have hand-coded.

We ship to production daily. You'll have customer-facing impact in week one, not quarter two.

## What we're looking for

This is a founding engineer role, not a specialist one. We care more about how you think than which frameworks you've memorized. The people who thrive here usually:

* **Reason from first principles.** A physics, math, or competitive-programming background is a strong signal — not for the credential, but for the habit of decomposing an unfamiliar problem and testing hypotheses against reality. * **Are comfortable being fuzzy.** Compliance is ambiguous, our roadmap moves, and you'll context-switch across regulatory domains constantly. You're someone who can hold uncertainty and still ship. * **Communicate exceptionally well.** This is near the top of our list. You'll work directly with banks and translate between regulation, code, and customers — clear thinking on the page and out loud matters as much as clean code. * **Own problems end-to-end.** Customer obsession over ticket-closing. You don't hand off at the edge of your function; you follow the problem until the customer's outcome is right. * **Are product-minded.** Backend depth in Python (we run Django) and experience shipping real LLM systems — RAG, agentic workflows, evaluation harnesses — are genuinely useful here. But product judgment beats stack mastery, and a security background, while interesting, isn't required.

A fintech, banking, or consulting background is a plus — regulatory familiarity shortens the ramp. But what we're really hiring for is someone who finds it interesting that a $0.09 discrepancy on a minimum payment is a finding.

We believe regulatory compliance shouldn't be a bottleneck on financial innovation, and that the way you earn a bank's trust is by showing your work — both of which shape how we build.

## Logistics

* San Francisco, hybrid. We value in-person collaboration but aren't dogmatic about a 5-day mandate. * Founding-level equity and salary. * We can't sponsor visas right now, and we're hiring in U.S. time zones.

If this sounds like your kind of problem, reach out — a short note about something hard you've shipped goes a long way.