Application Security Engineer Full Time

Summary:

MoonPay, a leading Web3 infrastructure company, seeks an Application Security Engineer to join its Product Security team. With over 20 million users trusting their payment and NFT minting solutions, MoonPay collaborates with prestigious brands and offers a consumer app. The role involves securing systems through threat modeling, penetration testing, and managing security tools, contributing to a secure Web3 environment.

Responsibilities:

• Conduct thorough threat modelling of Technical Design Documents (TDD) practices and provide actionable recommendations for improvement.
• Contribute to and support penetration testing activities, including vulnerability assessments and PoC development.
• Triage, respond and investigate Bug Bounty program reports.
• Implement and manage Web Application Firewalls (WAFs) and other security tools, preferably with experience in Cloudflare.
• Collaborate with development teams to integrate security best practices throughout the software development lifecycle (SDLC).
• Research and evaluate emerging security threats and vulnerabilities, and develop mitigation strategies.
• Develop and deliver security training and awareness programs to engineering teams.
• Contribute to the development and maintenance of security standards and keeping documentation up to date.
• Lead and participate in incident response activities, including investigation and remediation.

Requirements:

• You developed a breadth of experience across multiple security domains, including application security, infrastructure security, cloud security, and mobile security, with a proven ability to connect and integrate these areas for a holistic security approach.
• You have a strong understanding of Threat Modelling principles and their application to secure software development.
• You have hands-on experience with penetration testing methodologies and tools.
• You had previous experience with WAF configuration and management, ideally including Cloudflare.
• You performed mobile penetration testing and acquired techniques and tools.
• You have proficiency in Javascript and Typescript programming languages.
• You are comfortable explaining technical concepts like vulnerabilities and discussing effective mitigations.
• You are self-motivated, can work effectively in a remote setting while maintaining a team-focused mindset.
• Your background experience includes working in a disruptive technology, successfully launching products, ideally, within FinTech, SaaS, Crypto.
• If you hold relevant security certifications (e.g., CISSP, OSCP, CEH) are a plus but not required.
• You have a good understanding of cryptography and its applications.
• You contribute to the security community in open source, by participating in CTFs, or giving talks at local information security conferences.

Benefits:

• Equity package.
• Unlimited holidays.
• Paid parental leave.
• Annual training budget.
• Home office setup allowance.
• Monthly budget to spend on our products.
• Working in a disruptive and fast-growing industry where the possibilities are endless.
• Freedom, autonomy and responsibility.