Senior Application Security Engineer

Summary/Objective

The Senior Application Security Engineer is responsible for helping secure the Paymentus SaaS platform by partnering directly with software engineering, product, cloud infrastructure, DevOps, and security teams to identify, assess, and remediate application security risks across web applications, RESTful APIs, microservices, cloud-native services, and AI-enabled application components.

This is a hands-on technical role reporting to the Manager of Platform Security. The Senior Application Security Engineer will perform secure design reviews, threat modeling, source code review, API security assessments, application security testing, vulnerability validation, and remediation guidance for applications and services that support Paymentus’ payment technology platform.

The successful candidate must have strong hands-on software development experience, deep knowledge of modern application security, and the ability to work effectively with engineering teams to improve security without unnecessarily slowing product delivery. This role requires practical expertise in SaaS application security, RESTful API security, cloud-native application patterns, secure coding, software supply chain risk, and emerging AI/LLM application security risks.

Essential Functions/ Responsibilities

Perform application security reviews for Paymentus SaaS platform applications, services, APIs, and supporting application infrastructure.

Partner with software engineering teams to embed security into the software development lifecycle, including requirements, architecture, design, development, testing, deployment, and post-release operations.

Conduct threat modeling and secure architecture reviews for web applications, RESTful APIs, microservices, cloud-native services, AI-enabled features, and integrations with internal and external systems.

Review source code and application design for services written primarily in Java, NodeJS, Python, and Golang.

Assess application security risks in frameworks and platforms including, but not limited to, Spring, Struts, Express, Flask, Django, FastAPI, LiteLLM, and related open-source or commercial application frameworks.

Identify, validate, and help remediate common application security vulnerabilities, including injection flaws, broken access control, authentication weaknesses, authorization bypasses, insecure deserialization, SSRF, XXE, XSS, CSRF, business logic flaws, insecure file handling, secrets exposure, and sensitive data leakage.

Perform API security assessments for RESTful APIs, including review of authentication, authorization, object-level access control, function-level access control, input validation, rate limiting, excessive data exposure, resource consumption controls, versioning, and API inventory management.

Apply modern application security guidance, including OWASP Top 10, OWASP API Security Top 10, and OWASP Top 10 for Large Language Model Applications, to practical engineering scenarios.

Assess AI and LLM-enabled application components from an application security perspective, including risks such as prompt injection, insecure output handling, sensitive information disclosure, excessive agency, insecure tool or plugin integration, model abuse, and AI supply chain concerns.

Provide secure design guidance for applications using LLM gateways, model orchestration layers, retrieval-augmented generation, AI agents, third-party AI services, and frameworks such as LiteLLM.

Support security reviews of application servers, web servers, reverse proxies, and related runtime components, including Tomcat, JBoss, nginx, and similar technologies.

Review application and API security controls deployed through edge and CDN platforms such as Cloudflare and Fastly, including WAF rules, bot mitigation, rate limiting, caching behavior, header controls, TLS configuration, and origin protection.

Assess application security implications of cloud-native deployments across AWS, GCP, and Azure, including identity and access management, secrets handling, encryption, workload isolation, logging, service-to-service communication, and secure configuration.

Review application deployment patterns involving Kubernetes, containers, container registries, CI/CD pipelines, infrastructure as code, and serverless technologies.

Help define and improve secure coding standards, application security requirements, design patterns, reusable security controls, developer guidance, and security review procedures.

Perform manual and automated application security testing using tools and techniques such as SAST, DAST, SCA, container image scanning, IaC scanning, secrets detection, API security testing, dependency analysis, and manual penetration-style validation.

Validate security findings for exploitability, business impact, severity, compensating controls, and appropriate remediation strategy.

Provide clear, actionable remediation guidance to engineering teams, including code-level recommendations, secure configuration changes, design alternatives, and risk-based prioritization.

Support vulnerability management activities for application security findings, including triage, severity validation, remediation tracking, exception review, SLA management, and reporting.

Assist with penetration testing activities, external assessments, customer security reviews, bug bounty intake, red team findings, and remediation validation related to Paymentus applications and APIs.

Collaborate with Security Operations and Incident Response teams to improve application-layer logging, detection opportunities, attack-path analysis, and post-incident corrective actions.

Contribute to security automation and developer enablement initiatives, including CI/CD security gates, self-service security checks, reusable libraries, secure service templates, and policy-as-code.

Research emerging threats, vulnerabilities, exploitation techniques, application security patterns, API security risks, AI security risks, and cloud-native security trends that may impact the Paymentus platform.

Communicate application security risks clearly to engineering, product, security, and leadership stakeholders.

Help maintain security standards and practices that support Paymentus’ obligations as a publicly traded fintech and payment technology company, including PCI DSS, SOC 2, SOX-related technology controls, privacy obligations, customer security commitments, and internal security policies.

Supervisory Responsibility

This role does not have direct supervisory responsibility.

The Senior Application Security Engineer is expected to provide technical leadership, mentorship, and guidance to software engineers, security engineers, and other technical stakeholders. This includes helping engineering teams understand security risks, adopt secure coding practices, and remediate application security issues effectively.

Education and Experience

Bachelor’s Degree in Engineering, Computer Science, Software Engineering, Information Security, or a related technical field, or equivalent practical experience.

6+ years of experience in software engineering, application security, product security, platform security, security engineering, or a closely related technical role.

Extensive hands-on development experience in one or more of the following languages: Java, NodeJS, Python, Golang.

Strong understanding of modern SaaS application architecture, web applications, microservices, distributed systems, RESTful APIs, authentication, authorization, session management, secure data handling, and service-to-service communication.

Deep knowledge of application security vulnerabilities and secure remediation patterns.

Strong knowledge of API security risks, including broken object-level authorization, broken function-level authorization, excessive data exposure, mass assignment, unrestricted resource consumption, improper inventory management, and unsafe third-party API consumption.

Strong understanding of modern application security guidelines, including OWASP Top 10, OWASP API Security Top 10, and OWASP Top 10 for Large Language Model Applications.

Practical knowledge of AI and LLM application security risks, including prompt injection, insecure output handling, sensitive data exposure, insecure plugin/tool usage, model misuse, excessive agency, and AI supply chain concerns.

Hands-on experience performing secure code review, threat modeling, architecture review, vulnerability validation, and security testing.

Experience using and tuning application security tools such as SAST, DAST, SCA, container scanning, IaC scanning, secrets scanning, and API security testing tools.

Experience securing applications deployed in one or more public cloud environments, including AWS, GCP, or Azure.

Knowledge of Kubernetes, containerization, container registries, container image hardening, workload identity, secrets management, network policies, and runtime security concepts.

Knowledge of serverless application security, including function permissions, event validation, input handling, logging, dependency control, and abuse prevention.

Familiarity with application servers, web servers, and reverse proxy technologies such as Tomcat, JBoss, nginx, or similar platforms.

Familiarity with CDN, WAF, bot mitigation, rate limiting, and edge security controls using platforms such as Cloudflare and Fastly.

Experience working with CI/CD pipelines, source control systems, artifact repositories, build systems, infrastructure as code, and developer workflow automation.

Ability to analyze security findings, determine exploitability, identify root cause, and recommend practical remediation steps.

Ability to work independently, manage multiple priorities, and deliver high-quality results in a fast-paced engineering environment.

Strong written and verbal communication skills, including the ability to explain security issues clearly to technical and non-technical stakeholders.

Strong collaboration skills and the ability to build trusted working relationships with engineering, product, DevOps, cloud infrastructure, compliance, and security teams.

Preferred Qualifications

• Experience working in fintech, payments, banking, financial services, or another highly regulated SaaS environment.
• Experience with payment processing, cardholder data environments, tokenization, fraud controls, transaction platforms, or payment APIs.
• Experience supporting PCI DSS, SOC 2, SOX technology controls, NIST CSF, ISO 27001, or similar security and compliance frameworks.
• Experience with Spring Security, Java security libraries, OAuth 2.0, OIDC, SAML, JWT, mTLS, API gateways, and service-to-service authentication patterns.
• Experience with Kubernetes admission controls, service mesh security, policy-as-code, runtime detection, and cloud workload protection platforms.
• Experience building secure shared libraries, developer security tooling, reusable security controls, or paved-road security patterns.
• Experience with bug bounty programs, red team engagements, penetration testing, or exploit development.
• Relevant certifications such as CSSLP, CISSP, CCSP, GWAPT, GWEB, OSWE, AWS Security Specialty, Google Professional Cloud Security Engineer, Azure Security Engineer, CKS, CKAD, or equivalent practical experience.

Salary $110k-$150k

Work Environment

This job operates in a professional office and technology environment. This role routinely uses standard office and engineering equipment, including laptop computers, collaboration tools, cloud platforms, security platforms, source code repositories, ticketing systems, and communication systems. The role requires frequent collaboration with geographically distributed teams and may involve participation in security incident response, urgent vulnerability remediation, production risk reviews, and executive briefings.

Physical Demands

While performing the duties of this job, the employee is regularly required to talk, hear, type, read, and view computer screens for extended periods. Specific vision abilities required by this job include close vision and the ability to adjust focus. The employee may occasionally be required to stand, walk, reach with hands and arms, lift files or equipment, open filing cabinets, bend, or stand on a stool as necessary. The employee may occasionally be required to lift up to 25 lbs.

Position Type/Expected Hours of Work

This is a full-time position. Days and hours of work are generally Monday through Friday during normal business hours. Occasional evening, weekend, or on-call work may be required based on business needs, security incidents, critical vulnerabilities, production releases, audit deadlines, or customer commitments.

Travel

Minimal travel is expected. Occasional travel may be required for company meetings, team events, customer security discussions, conferences, audits, or vendor engagements.

Other Duties

This job description is not designed to cover or contain a comprehensive listing of all activities, duties, or responsibilities required of the employee. Duties, responsibilities, and activities may change at any time with or without notice.

EEO Statement

Paymentus is an equal opportunity employer. We enthusiastically accept our responsibility to make employment decisions without regard to race, religious creed, color, age, sex, sexual orientation, national origin, ancestry, citizenship status, religion, marital status, disability, military service or veteran status, genetic information, medical condition including medical characteristics, or any other classification protected by applicable federal, state, provincial, and local laws and ordinances.

Our management is dedicated to ensuring the fulfillment of this policy with respect to hiring, placement, promotion, transfer, demotion, layoff, termination, recruitment advertising, pay, and other forms of compensation, training, and general treatment during employment.

Reasonable Accommodation

Paymentus recognizes and supports its obligation to endeavor to accommodate job applicants and employees with known physical or mental disabilities who are able to perform the essential functions of the position, with or without reasonable accommodation. Paymentus will endeavor to provide reasonable accommodations to otherwise qualified job applicants and employees with known physical or mental disabilities, unless doing so would impose an undue hardship on the Company or pose a direct threat of substantial harm to the employee or others.

An applicant or employee who believes he or she needs a reasonable accommodation of a disability should discuss the need for possible accommodation with the Human Resources Department, or his or her direct supervisor.