---
title: 'Head of Security & Compliance at Casca'
canonical: 'https://feeny.ai/job/head-of-security-compliance-casca-san-francisco-8mk0kvv43chd'
type: 'job'
last_seen: '2026-09-09'
---

# Head of Security & Compliance at Casca

- **Company:** Casca
- **Location:** San Francisco, CA
- **Compensation:** $200k–$255k
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-06-26
- **Last confirmed live:** 2026-09-09
- **Apply:** https://jobs.ashbyhq.com/casca/7b47e67a-8953-494f-a9df-90a763124c95/application

**Skills:** Secure SDLC, Cloud Security, AWS, GCP, Web Security, DevSecOps, SOC 2, ISO 27001, Penetration Testing, Incident Response, LLM Security, Agentic Systems Security, Prompt Injection Mitigation, Data Poisoning Mitigation

> Lead security and compliance strategy for Casca's AI-driven banking platform. Build security tooling, manage the application security team, and drive compliance roadmaps including SOC 2 and ISO 27001. Partner with engineering and product to secure AI workflows and ensure data privacy.

## Job description

WHY CASCA?

Casca is building AGI for banking. We’re replacing decades-old legacy systems with AI-native technology that automates 90% of the manual work humans once had to do.

## WHAT YOU'LL DO:

- Build security tooling & processes that engineers actually use. Create internal mechanisms for appsec, identity and access management, and threat detection that naturally integrate into how the team ships.
- Manage, mentor, and grow our team of application security engineers. Mature our Secure SDLC, threat modeling, and vulnerability management processes to ensure our security posture matches our growing responsibility..
- Secure the agent execution surface. Partner with Engineering and Product to establish robust security architecture for our AI-driven workflows, ensuring strict data privacy, mitigating AI-specific vulnerabilities, and maintaining safe agentic identity.
- Drive customer trust. Partner with go-to-market and legal teams to support compliance and customer-driven initiatives. Own and expand our compliance roadmap (SOC 2, SOC 1, ISO 27001), while keeping guardrails pragmatic for a fast-paced startup.
- Lead incident response and detection. Build the detection pipeline, act as the primary commander, and turn every event into systemic improvements.

## WHAT YOU'LL BRING:

- 5+ years in progressive security roles, with at least 2+ years at a B2B tech, fintech, or highly regulated SaaS company.
- Strong fundamentals in secure SDLC, cloud security (AWS/GCP), Web security, and DevSecOps practices.
- Ability to develop lightweight, durable security policies, access controls, and data governance frameworks. A track record of building "practical security, not checkbox theater."
- Nice to have: Experience securing LLM usage for both coding and in product use cases, and mitigating risks specific to agentic systems (e.g., unauthorized actions taken by autonomous agents, prompt injection, and data poisoning)
- Proven track record of owning SOC 2 Type II and/or ISO 27001 compliance.
- You can review a penetration test, debate architecture with a lead engineer, and present to a bank's CISO…all in the same day
- You’re comfortable with incident response - calm, methodical, and effective under pressure; experience leading incidents end to end & driving the fixes that follow.
- You thrive in ambiguity, know how to ruthlessly prioritize fixes to eliminate the highest risks first, and understand the balance between security and business velocity.
- Experience in fintech or banking

## WHAT YOU'LL GET:

- Impact & Ownership: A unique opportunity to shape the future of banking through AI, owning end-to-end product initiatives.
- Collaborative Environment: Work alongside a talented and passionate team that values continuous improvement and knowledge sharing.
- Competitive Compensation: Includes salary, benefits, and potential equity in a fast-growing startup.
- Professional Growth: Access to resources and mentorship to expand your skill set, influence strategy, and accelerate your career.
- Culture of Innovation: We encourage risk-taking, learning from failures, and pushing the boundaries of what’s possible in fintech.

As an early-stage company building at the frontier of AI, we work with high intensity and commitment. While schedules can vary by role/team, many weeks will demand extra focus, flexibility and time particularly during major launches and high impact sprints. We're seeking those who are aligned to and able to commit to that expectation.

## About Casca

## Company Overview
- **One-liner**: Casca provides an AI-native loan origination platform that helps banks and lenders automate business lending, reducing manual effort by 90% and cutting loan cycle times by days.
- **Entity Type**: Private (Series A)
- **Headquarters**: San Francisco, California, USA (564 Market Street, Suite 700)
- **Founded**: 2023
- **Founders**: Lukas Haffer (Co-Founder & CEO)

## Core Business
- **Primary industry**: Financial technology (Fintech) – specifically small business lending software.
- **Target customers**: FDIC-insured community banks, regional banks, and national lenders (B2B, Enterprise).
- **Mission**: Unlock affordable bank funding for the 30M+ small businesses in the US by automating the manual effort that deters banks from lending.

## Products & Services
- **Casca Apply**: A modern, digital loan application form with a secure applicant portal that auto-fills applicant information to boost conversion rates by 3x.
- **AI Loan Assistant “Sarah”**: An AI-powered assistant that guides applicants through the process, answers questions, and completes applications in record time.
- **Automated Document Collection & Analysis**: Reads 10,000+ pages of financial documents (tax returns, bank statements, rent rolls) to extract key data.
- **KYB (Know Your Business) Checks**: Integrated identity and compliance checks.
- **Underwriting AI**: Supercharges underwriters by automating data entry from PDFs into Excel, enabling them to focus on business analysis.
- **30+ Native Integrations**: Connects with leading data providers for faster credit decisioning.

## Market Standing
- **Valuation/Market Cap**: Not publicly available.
- **Key Metric**: Total funding of $33.4M (latest round: $29M Series A in August 2025).
- **Notable Investors/Partners**: Canapi Ventures (lead Series A), Y Combinator (Summer 2023 batch), Peterson Ventures, Live Oak Ventures. Advisor includes the Co-Founder of Live Oak Bank & Canapi Ventures.
- **Growth Signals**: Named a 2026 Best Places to Work in Fintech by American Banker; team size of 40 (as of mid-2026); actively scaling; product-market fit claimed.

## Competitive Advantages
- **AI-native platform** purpose-built for business lending, replacing manual processes with automation.
- **Deep integrations** (30+ native data providers) reduce loan cycle time by an average of 5 days.
- **Proprietary AI** that reads complex financial documents (10,000+ pages) and pre-qualifies applicants in 5 minutes.
- **Security & compliance** focus with FDIC-insured bank partners.

## Strategic Focus
- Continue scaling the team and product as the “AGI for banking,” aiming to originate 10x more loans with 90% less manual effort.
- Expand partnerships with regional and national banks while deepening existing integrations.
- Maintain in-person collaboration culture to accelerate innovation in a high-intensity startup environment.

## Why Work Here
- **Culture**: Emphasizes innovation, risk-taking, impact, and ownership. Collaborative environment with knowledge sharing.
- **Work Policy**: In-person, 5 days a week in the San Francisco office (SOMA). High intensity, especially during major launches.
- **Perks**: Daily meals (breakfast, lunch, dinner), snacks and drinks; comprehensive medical/dental/vision insurance; 401(k); flexible PTO; commuter support.
- **Growth**: Access to mentorship, resources, and the opportunity to shape the future of banking AI. Competitive salary plus equity.
- **Recognition**: Named a 2026 Best Places to Work in Fintech by American Banker.

## Sources
1. [cascading.ai](https://www.cascading.ai/)
2. [cascading.ai/careers](https://www.cascading.ai/careers)
3. [cascading.ai/company/company](https://www.cascading.ai/company/company)
4. [ycombinator.com/companies/casca](https://www.ycombinator.com/companies/casca)
5. [cbinsights.com/company/cascading-ai](https://www.cbinsights.com/company/cascading-ai)

## Other roles at Casca

- [Technical Recruiter](https://feeny.ai/job/technical-recruiter-casca-san-francisco-n7g3jmdv86hr) — San Francisco, CA
- [Forward Deployed Engineer](https://feeny.ai/job/forward-deployed-engineer-casca-san-francisco-pksjfa9hg9p8) — San Francisco, CA
- [Director of Customer Support](https://feeny.ai/job/director-of-customer-support-casca-san-francisco-cr98yjx5f6q7) — San Francisco, CA
- [Don't See the Perfect Fit?](https://feeny.ai/job/don-t-see-the-perfect-fit-casca-san-francisco-n7tk1s87jcpp) — San Francisco, CA