Cross River

Cross River is a financial infrastructure company operating as a state-chartered bank, founded in 2008 and headquartered in Fort Lee, New Jersey, with an additional presence in Jerusalem. The company serves millions of consumers and businesses through its proprietary API-driven banking core, which powers embedded payments, card issuing, digital lending, and real-time money movement for fintech partners. That dual identity - bank charter plus engineering org of over 1,600 - means the security surface is broad: regulatory compliance obligations from multiple agencies, customer financial data at scale, and increasingly, cryptocurrency and stablecoin payment rails that introduce novel threat vectors around key management, smart contract integrity, and transaction finality. For a security team, the attack surface here isn't theoretical. Cross River's infrastructure sits between fintech platforms and the actual banking system, processing real money flows across embedded payment, lending, and crypto-adjacent domains. The threat model includes API abuse against a core banking platform that third parties build on, fraud vectors in digital lending pipelines, and the intersection of traditional financial compliance requirements with the less-settled security posture of cryptocurrency solutions. Defending this means working across application security, fraud detection, infrastructure hardening, and regulatory compliance tooling simultaneously. The technical domains - API-driven banking, embedded payments, stablecoin and crypto integration - require engineers and security practitioners who understand both legacy financial systems and modern distributed architectures. The company's stated model of blending bank-grade regulatory rigor with tech-company agility suggests a security function that has to satisfy audit and compliance while moving at the pace of product shipping. Whether that tension is productive or painful depends on the team, but the scope of the problem is concrete and the stakes are financial.