When you visit SoFi.com or open the app and tap "Login," you’re interacting with the digital front door of your financial life. For most, it’s a three-second ritual. For Mukul Shishodiya, Senior Manager of Software Engineering, it is the culmination of 15 years of expertise in authentication and a non-stop mission to stay one step ahead of the world’s most sophisticated bad actors.
Leading a team of ten engineers, Mukul is responsible for the critical infrastructure that handles every single SoFi member login. We sat down with Mukul to discuss the unique challenges of fintech security, why he spends his free time on Reddit, and how his team balances ironclad security with a seamless member experience.
The Stakes of the "Login"
In the world of B2B software, a login delay might be a nuisance. In fintech, it’s an emergency.
"Everyone wants access to their money," Mukul explains. "Imagine a scenario where login is down for a couple of hours and you can’t access your funds. That’s why our team is so impactful: we have to ensure the system is stable and accessible 24/7."
Since joining SoFi four years ago, Mukul has grown the team from three engineers to ten, shifting the focus from mere "maintenance" to proactive innovation. His team doesn’t just build a gate; they build a system that recognizes the person holding the key.
"Fintech is different because it’s consumer-focused. We aren't just dealing with code; we're dealing with people's livelihoods. We have to be one step ahead of fraudsters who are constantly enhancing their skills with AI."
Member-Obsessed Engineering: From Reddit to Production
While many engineering leaders rely solely on internal roadmaps, Mukul and his Product Managers have a different secret weapon: Reddit.
"The cool thing about my team is that whenever we launch something, there’s a buzz on Reddit within one or two hours," Mukul says. "We monitor those channels closely to see what our customers are actually asking for."
This crowdsourced strategy has led to tangible features that members use every day:
- Google Authenticator: A year and a half ago, the team introduced support for authenticator apps as a more secure alternative to SMS-based 2FA—directly answering member feedback.
- In-App Notification: To combat phone scammers pretending to be SoFi employees, the team launched a feature that displays a notification within the app to confirm that an official SoFi representative is actually calling.
Beyond the Code: Educating the Member
Mukul believes that security is a partnership between the platform and the member. His team’s charter has expanded to include member education, using the login flow to teach safer habits.
"If you log in from a new device, you’ll immediately get an email," says Mukul. "That’s an education piece. It helps prevent account takeovers. We want to empower our members to understand how to keep their accounts safe, like moving away from weaker options like email or SMS toward more robust 2FA."
Why SoFi?
With 15 years in the domain, Mukul has seen every side of the security world. What keeps him at SoFi is the agility and the lack of red tape that often stifles big tech.
"In bigger companies, it’s very process-oriented. It’s hard to get buy-in. At SoFi, I can see something on Reddit, share it with my leadership, and we make it happen. We value our members' experience enough to be flexible, but we never compromise on the security side. It’s a thin line, but it’s what we do best."
Mukul’s Pro-Tip for Members
"A lot of people think phone OTP (SMS) is enough, but fraudsters are clever, they use things like SIM swapping to intercept codes. If you have the option, always use an authenticator app or a Passkey for the highest level of security so you’re not vulnerable to interception attacks!"
