ABOUT HALOCARD

What we are: The fastest and most transparent way to get US-issued, virtual credit cards for anyone in 120+ countries. No credit checks. No US residency required. Signup to payment takes < 5 minutes.

What we want to become: A private and transparent neobank anyone can use to move money and make payments around the world like a first world citizen, with privacy built in.

THE SITUATION

- 9 months live with thousands of customers
- Profitable with zero VC money
- Growing 30% month-over-month
- Almost a third of our recent commits were written by AI agents The product works. Now it has to keep working at 10x the volume while we add new features, funding rails, and financial APIs. You'll be our second full-time engineer, working directly with our ex-Meta CTO on systems that move real money, and directing the agents that help build them.

HOW WE BUILD

- Agents write, humans decide. You'll run several coding agents in parallel on scoped tasks and review every diff before it ships
- Our standards live in the repo as rules agents follow, so code written by an agent meets the same bar as yours. You'll write and tighten those rules
- Every PR runs automated checks for privacy leaks, UI and copy standards, security regressions, and an AI code review before a human signs off
- You'll build internal agents for support, fraud review, and reconciliation, so the team stays small as volume grows
- Agents never get production secrets, PII or money-moving permissions. You'll design and enforce the guardrails that keep it that way THE STACK
- JavaScript, React, and Next.js
- Tailwind, Radix, Zustand, TanStack Query, React Hook Form, and Zod on the front end
- Native Android and iOS for mobile
- Postgres on Supabase, with Realtime
- Serverless hosting on Vercel
- BaaS and card issuing APIs, with embedded wallets, on-chain collateral contracts, and stablecoin settlement on EVM and Solana chains




- Payment processor APIs across fiat and crypto
- Identity check (KYC), bot protection, row-level security, audit logging, and kill switches
- Playwright tests, product analytics, and Claude Code reviewing every PR

WHO YOU ARE

- Someone who makes flaky financial APIs reliable: webhooks that arrive twice, late, or never, plus idempotency, retries, and reconciliation
- Fluent in two worlds: you can trace a card authorisation back to the collateral contract funding it, and say where the money sits at every step
- A Postgres person who reaches for RLS, constraints, and idempotent migrations before app-side checks
- Security-first: least privilege, secrets hygiene, audit trails, and threat modelling are habits, not tickets
- Compliance-aware: KYC, AML, sanctions, and data privacy rules are design constraints you build into the system from the start
- Product-minded: you care what the user sees when a deposit is pending or a card declines
- AI-native: you orchestrate agents with Claude Code or Cursor, ship faster because of them, and still own every line that merges
- Happy to own a feature from schema to UI copy to the incident at 2am

YOU'RE PERFECT IF

• You're obsessive about building a great product

- You've built payment, card, or banking systems handling real money in production
- You've worked with smart contract collateral, custody, or stablecoin settlement behind a card or payment product
- You've shipped in a regulated workplace: KYC/AML, PCI DSS scope, or SOC 2
- You've shipped a production Next.js app on Postgres




- You can show us something you built that people pay for, and the agentic workflow you used to build it

BONUS POINTS

- Card issuing, Visa authorisation flows, or dispute handling
- Smart contracts, stablecoins, or wallet infrastructure on EVM and Solana chains
- Fraud, abuse, or KYC pipelines
- Building AI agents that act on real systems: tool calling, MCP servers, evals, and guardrails
- Native Android or iOS payments, for when tap to pay lands THE SCENARIO

• It's three of us. You'll own things end to end, including when they break. This is not a traditional 9-5.

- We have a few house rules: no polling, no new API routes, no file over 300 lines, every migration idempotent. Follow them, then argue to change the ones that are wrong
- Partners change APIs, deprecate endpoints, and go quiet. Your job is to make that invisible to users
- Security, compliance, and privacy aren't a department here. They're part of every PR, and some of them will shape your architecture

WHAT YOU GET

• A$120K + equity. Below market and a startup, hence the upside

- Ownership of core systems at a profitable fintech
- No sprint theatre, no ticket graveyards, no committee
- Thousands of people using what you ship the day you ship it TO APPLY

Please don't send a resume or apply through LinkedIn. Do this instead:
- Sign up at halocard.co and go as far through onboarding as you're comfortable. Tell us the first thing you'd fix and why
- In up to 10 bullets: You’re giving an internal AI support agent the ability to lock cards and issue refunds. What can it do alone, what needs human approval, and how do you audit it?
- Link one thing you built that moves money, plus what broke and how you fixed it
- Show us how you work with agents: a rules file, a workflow, or a short screen recording of you shipping with them

Submit to halocard.co/careers

Please no cover letters or AI slop.

📌 Full Stack Engineer (Melbourne)
🏢 Halocard
📍 Melbourne