Application Security Engineer, Payments — Remote (Worldwide)

Location and working arrangements

Applicant eligibility: Worldwide

• Vacancy-wide (no geographic assertion): Remote

Overview

Own application-security decisions for a payments platform, with particular attention to backend services and APIs that move money. The role sets a practical standard for the validity and severity of findings and the changes needed before release. You will work directly with engineers and often implement the fix as well as identify the weakness.

Requirements

• Candidates need at least four years in application security, product security or security-focused backend engineering.
• TypeScript or Node.js code analysis, cloud security and infrastructure-as-code experience are required.
• Experience with threat modeling or architecture reviews is required; payment-security, penetration-testing and scanner-development backgrounds are advantages.

Responsibilities

• Reproduce findings from security testing, remove false positives and write actionable remediation work.
• Improve severity assessment and automated checks that prevent vulnerable changes from merging.
• Review new or high-risk architectures and maintain coverage of the attack surface as the platform evolves.
• Strengthen edge protections, including rate limiting, denial-of-service defenses and web application firewall rules.
• Develop secure configuration baselines for cloud resources, code and software services, then turn them into repeatable checks.
• Evaluate security tools according to their usefulness, including whether to adopt, purchase or build a capability.
• Use AI-assisted tooling critically when it improves the work.

Conditions

• This is a full-time fully remote role.

Tech stack

• TypeScript
• Node.js
• Terraform
• GCP (preferred)