QA engineer (auto) in application security

Hyperlayer; Greater London; On-site; GBP 75,000 - 95,000; Full time

Benefits offered by this job

Performance-based bonus

25 days annual leave + holidays

Critical illness and life insurance

AXA PPP Health Insurance

Cycle-to-work

Referral bonus

Workplace nursery

Job summary

Hyperlayer is seeking a security-focused QA engineer in London to test APIs and applications against OWASP Top 10. You’ll automate security tests, integrate them into CI/CD, and contribute to threat modelling.

Role requires 5+ years in QA/security, hands-on API testing, and experience with ZAP/Burp. Office-based in Paddington, with a strong emphasis on secure, scalable banking-grade testing.

Qualifications

• 5+ years in QA, quality engineering or application security, including at least 3 years of hands-on security testing of APIs and web applications.
• Strong practical knowledge of the OWASP API Security Top 10 and OWASP Top 10.
• Hands-on experience with security testing tools such as OWASP ZAP or Burp Suite.
• Experience with authentication and authorisation: OAuth 2.0, OpenID Connect, JWT, session handling and RBAC.
• Experience automating tests in Java (or another JVM language) using REST Assured or similar.
• Experience adding security testing to CI/CD pipelines (e.g. Jenkins, Bitbucket Pipelines, GitHub Actions) and triaging scanner findings.
• Able to explain risk and severity clearly to engineers and non-specialists.
• Willing to be in our London office four days per week; valid right to work in the UK.

Responsibilities

• Test our APIs and apps against the OWASP API Security Top 10 and OWASP Top 10.
• Build automated security tests and integrate them into CI/CD pipelines.
• Participate in threat modelling and design reviews for new features.
• Triage scanner findings and verify fixes with engineering.
• Prepare for external penetration tests and communicate risks clearly.

Skills

Security testing

API testing

CI/CD pipelines

OAuth 2.0

OpenID Connect

Tools

OWASP ZAP

Burp Suite

REST Assured

Jenkins

GitHub Actions

Job description

Описание:

Hyperlayer is the intelligent banking platform built for the agentic economy: the financial control layer that sits above banks' existing cores, enabling next-generation Smart Accounts, without ripping anything out. From a single integration, we give financial institutions a secure rules and orchestration engine that lets them design, launch and scale hyper-personalised products in weeks while preserving stability, compliance and control. And there's nothing like us anywhere in the world.

Задачи:

Test our APIs and apps against the OWASP API Security Top 10 and OWASP Top 10, with a focus on authentication, authorisation and data exposure. Make sure one bank can never see or change another bank's data, with automated tenant-isolation checks for every endpoint. Test agent-ready accounts: delegated permissions, spending limits, revocation and the audit trail for every agent action. Build automated security tests in Java and REST Assured, and turn every confirmed finding into a regression test. Add security checks to our CI/CD pipelines, such as DAST (e.g. OWASP ZAP), fuzzing (e.g. ffuf), SAST and dependency scanning, tuned so they don't create noise. Join design reviews and threat modelling for new features, and turn abuse cases into test cases. Prepare for external penetration tests, triage their findings with engineering, and verify fixes. Test HyperJar's mobile security, including secure storage, authentication and API usage, against OWASP MASVS. Report security risk clearly to inform release go/no-go decisions. Help other quality engineers add security checks to their own pods, using AI tools where they help and

Требования:

5+ years in QA, quality engineering or application security, including at least 3 years of hands‑on security testing of APIs and web applications. Strong practical knowledge of the OWASP API Security Top 10 and OWASP Top 10, with real findings you can talk about. Hands‑on experience with security testing tools such as OWASP ZAP or Burp Suite. Solid understanding of authentication and authorisation: OAuth 2.0, OpenID Connect, JWT, session handling and role-based access control. Strong API testing skills, with experience automating tests in Java (or another JVM language) using REST Assured or similar. Experience adding security testing to CI/CD pipelines (e.g. Jenkins, Bitbucket Pipelines, GitHub Actions) and triaging scanner findings. Ability to explain risk and severity clearly to engineers and non‑specialists. Comfortable in a fast‑moving startup environment, balancing speed with the rigour needed when testing financial systems. Willing and able to be in our London office four days per week. Candidates will need an existing non‑sponsored right to work in the UK. Будет плюсом: Experience in banking, payments or another regulated financial services environment, and awareness of expectations such as FCA rules, DORA or PCI DSS; Security certifications such as OSCP, OSWE, eWPT or CREST, or a background in penetration testing; Threat modelling experience (e.g. STRIDE); Mobile application security testing (OWASP MASVS, MobSF), ideally including Flutter apps; Experience testing multi‑tenant SaaS platforms or services written in Go; Awareness of security risks in AI and agent‑based systems, such as the OWASP Top 10 for LLM Applications; Cloud and container security experience (AWS, Docker, Kubernetes)

Условия:

This role is predominantly office‑based in Paddington, London. We will not be offering UK work visa sponsorship for these roles. At Hyperlayer we are proud of our in‑office culture. It makes a real difference to the working atmosphere and maximises collaboration in and across teams. This is critical to how we work and learn. Also, we think it makes for a great workplace!

• A performance‑based employee bonus scheme.
• 25 days annual leave plus bank holidays, a day off on your birthday, and an additional day per year of tenure to a maximum of 30.
• Critical illness and life insurance cover.
• AXA PPP Health Insurance, including gym offers.
• Cycle‑to‑work scheme.
• Referral bonus scheme.
• Workplace nursery scheme.

Equity, diversity, and inclusion