As a Senior Application Security Engineer, you will join Paystack's Information Security Team to play a critical role in securing their rapidly growing fintech platform and upholding customer trust. You will collaborate with Engineering, DevOps, and Product teams to embed security from application design to deployment, encompassing penetration testing, vulnerability management, and fostering a secure development culture.

You are a seasoned Application Security Engineer eager to protect systems, embrace technical challenges, and thrive in a fast-paced, collaborative setting. You will be integral to embedding security across Paystack's applications, from performing web, mobile, and API security assessments to providing proactive security guidance within development sprints. You won't just be executing tasks; you will drive the integration of security into the SDLC, assist in incident response, and contribute to innovative security solutions and frameworks. You will be the expert ensuring security is fundamental to everything Paystack builds.

What you'll do

Conduct web, mobile, and API security assessments, including threat modelling, secure code reviews, and attack surface analysis.
Support and enhance SAST and DAST initiatives.
Manage the vulnerability lifecycle, coordinating internal/external security assessments and tracking remediation.
Integrate secure development practices into the SDLC by collaborating with development teams and contributing to security frameworks (OWASP, NIST, MITRE).
Implement and maintain DevSecOps testing and protective controls.
Assist in the investigation and resolution of application security incidents, contributing to post-incident analysis and preventative measures.
Stay current on cybersecurity trends, research and implement innovative security solutions, and identify process improvements for security assessments.

Requirements

You have a minimum of 5 years of experience in application security, IT security, or software development with a security focus.
You possess hands-on experience with penetration testing, vulnerability assessments, and secure code reviews.
You have proven experience with SAST, DAST, and threat modelling frameworks.
You have practical knowledge of secure software development practices (OWASP Top 10, CWE).
You have hands-on development experience or scripting ability in Python, JavaScript, or Bash.
You demonstrate a strong understanding of web application security, API security, and cloud security concepts (AWS, Azure, or GCP).
You understand DevSecOps principles and CI/CD security integration.
You can effectively communicate complex security concepts to both technical and non-technical audiences.
You have a collaborative mindset and excel at working cross-functionally.

Nice to have

Bachelor's degree in Computer Science, Information Security, Cybersecurity, Software Engineering, or a related technical field.
Relevant coursework or self-study in application security, cryptography, or secure software development.
Prior experience working in a development or DevSecOps environment.
Understanding of fintech compliance frameworks (PCI DSS, ISO 27001, SOC 2, GDPR, NDPR).
Experience with mobile application security testing (iOS, Android).
Knowledge of MITRE ATT&CK framework or other threat intelligence frameworks.
Participation in bug bounty programs or CTF competitions.
Certifications such as OSCP, CEH, or CISSP.