Engineering Manager- Application Platform

About Us

OpenFX is on a mission to move money as freely as data, unrestricted by time zones, banking hours, or legacy systems. We are building the infrastructure that will power the next generation of cross-border payment systems for institutions. The team's execution has been exceptional, and we're scaling at a remarkable pace. Our stellar early team comes with experience in companies like J.P. Morgan, Goldman Sachs, FalconX, PayPal, Affirm, Polygon, Kraken, Nium & others. We're backed by Accel, Lightspeed, NfX and other top-tier investors.

Role Overview

OpenFX processes billions of dollars in transaction volume every month across global corridors. Application Platform owns the layer every other team builds on: the API gateway, authentication and session security, the admin surface, API standards and governance, identifiers, and the observability that makes production legible.

This is where the company's constraints collide. Security requires strong customer authentication, mTLS, and session controls. Product teams need to ship weekly. Auditors and cyber insurers need access controls and evidence. Engineering needs deployment hygiene that does not silently drift. Today these get resolved case by case, in meetings, at the cost of speed.

If we do not solve this well, every product team pays a tax in ambiguity, and one bad gateway or auth change becomes an outage on the money path.

Key Responsibilities

• Run the Application Platform pod of roughly 8 to 15 engineers and QA, with a Tech Lead reporting to you. You own the roadmap, the standards, and the on-call posture.
• Own the API gateway and edge: routing, plugins, rate limiting, mTLS and HMAC, and rollout strategy for changes sitting in front of production traffic with a rollback path that has actually been exercised.
• Own authentication and session security: strong customer authentication, re-authentication, new-device gating, session revocation, API key and credential management.
• Own API standards and governance: the standards document, the enforcement point, versioning conventions, identifier schemes, and a review process that stays real rather than aspirational.
• Make security review predictable: agree the interface with InfoSec so RFCs get scoped sign-off with named owners and dates, instead of open-ended review that stalls rollouts.
• Stay hands-on. You review designs, and you still write and ship code, debug production, and set the implementation bar by example, including the standard for AI-assisted development.
• Raise operational maturity: incident command and reporting, deployment and branch hygiene, delivery metrics that measure production reality, audit logging, and alerting that catches problems before customers do.
• Hire and grow th