Senior QA Engineer – Non-Functional (Performance & Security)

Hyperlayer; Greater London; On-site; GBP 70,000 - 110,000; Full time

Benefits offered by this job

Performance bonus

25 days annual leave + bank holidays +

Birthday + tenure day benefits

Critical illness and life insurance

AXA Health Insurance + gym offers

Cycle-to-work scheme

Referral bonus scheme

Workplace nursery

Job summary

Hyperlayer, the intelligent banking platform, seeks a Senior Quality Engineer to lead non-functional testing with a core focus on performance and secondary emphasis on security. You will design tests, set baselines, and integrate them into CI/CD and release certification, working alongside our QA and DevOps teams.

The role is predominantly office-based in Paddington, London. You will bring strong Java and REST Assured skills for API testing, create automated tests for critical payment journeys,

Qualifications

• 5+ years in QA or quality engineering, including at least 3 years focused on performance testing of APIs and distributed systems.
• Hands-on experience designing and running load, stress and soak tests as code with tools such as Gatling, JMeter or k6.
• Ability to model realistic workloads and interpret results: percentiles, throughput, saturation and resource use.
• Experience diagnosing performance problems with APM, metrics, logs and traces, and explaining findings clearly to engineers.
• Practical security testing experience against the OWASP Top 10 and OWASP API Security Top 10, using tools such as OWASP ZAP or Burp Suite.
• Strong Java skills (or another JVM language) and hands-on REST Assured experience for functional API testing.
• Experience adding non-functional tests to CI/CD pipelines, with sensible thresholds that don't create noise.
• Comfortable in a fast-moving startup environment, balancing speed with the rigour needed when testing financial systems.
• Willing and able to be in our London office four days per week.

Responsibilities

• Define non‑functional targets for latency, throughput, concurrency and error-rate thresholds.
• Design and run load, stress, soak and spike tests as code for critical API and payment paths.
• Set performance baselines and add automated regression gates to CI/CD and release certification.
• Find bottlenecks using APM and observability tools and work with engineers to fix them.
• Test APIs against OWASP API Security Top 10, especially auth and data exposure.
• Add automated security checks and fuzz testing to pipelines and support external pen tests.
• Test behaviour when dependencies fail: timeouts, retries, idempotency and rate limiting.
• Build functional and API tests in Java and REST Assured to support non-functional tests.
• Report performance and security risk to inform release go/no-go decisions.
• Create reusable tests and guides for other quality engineers, using AI tools where helpful.

Skills

Performance testing

API testing

Java

REST Assured

CI/CD integration

Load testing

Security testing

OWASP ZAP

Burp Suite

Datadog

Grafana

Tools

Gatling

JMeter

k6

OWASP ZAP

Burp Suite

Job description

About Hyperlayer

Hyperlayer is the intelligent banking platform built for the agentic economy: the financial control layer that sits above banks' existing cores, enabling next‑generation Smart Accounts, without ripping anything out. From a single integration, we give financial institutions a secure rules and orchestration engine that lets them design, launch and scale hyper‑personalised products in weeks while preserving stability, compliance and control. And there's nothing like us anywhere in the world.

Hyperlayer works with Tier 1 and Tier 2 FIs across the UK, US, EMEA and Hong Kong, with an award‑winning UK consumer app (HyperJar) sitting in the group. We're creating the fintech category that every bank in the world needs: programmable, governed, agent‑ready accounts. Your job is to make sure our audiences know that.

About Hyperlayer

Hyperlayer is the intelligent banking platform built for the agentic economy: the financial control layer that sits above banks' existing cores, enabling next‑generation Smart Accounts, without ripping anything out. From a single integration, we give financial institutions a secure rules and orchestration engine that lets them design, launch and scale hyper‑personalised products in weeks while preserving stability, compliance and control. And there's nothing like us anywhere in the world.

Hyperlayer works with Tier 1 and Tier 2 FIs across the UK, US, EMEA and Hong Kong, with an award‑winning UK consumer app (HyperJar) sitting in the group. We're creating the fintech category that every bank in the world needs: programmable, governed, agent‑ready accounts. Your job is to make sure our audiences know that.

About The Role

• We're hiring a Senior Quality Engineer to lead non‑functional testing across Hyperlayer, with performance as the core focus and security as a strong secondary skill.
• Banks and financial institutions rely on our platform, and HyperJar serves consumers directly, so we need to know how our systems behave under load, under attack and when dependencies fail.
• You'll make non‑functional testing routine: designing tests, setting baselines with engineering, and building them into our pipelines and release certification.
• You'll also bring strong functional and API testing skills in Java and REST Assured, so your tests are built around realistic payment journeys and business risk.
• You'll report into the Head of Solution Architecture & QA and work closely with our Principal Quality Engineer, Release Engineering and DevOps.
• This role is predominantly office‑based in Paddington, London.

What You'll Do

• Define non‑functional targets with engineering and product: p95/p99 latency, throughput, concurrency and error‑rate thresholds.
• Design and run load, stress, soak and spike tests as code (e.g. Gatling, JMeter, k6) for critical API, orchestration and payment paths.
• Set performance baselines and add automated regression gates to CI/CD and release certification.
• Find bottlenecks using APM and observability tools (e.g. Datadog, Grafana), and work with engineers to fix them.
• Test APIs against the OWASP API Security Top 10, especially authentication, authorisation and data exposure.
• Add automated security checks (e.g. OWASP ZAP) and fuzz testing to pipelines, and support external pen tests and fix verification.
• Test behaviour when dependencies fail or slow down: timeouts, retries, idempotency and rate limiting.
• Build functional and API tests in Java and REST Assured where needed, so non‑functional tests rest on reliable functional coverage.
• Report performance and security risk clearly to inform release go/no‑go decisions.
• Create reusable tests and guides so other quality engineers can add non‑functional checks to their pods, using AI tools where they help.

Qualifications

Essential

• 5+ years in QA or quality engineering, including at least 3 years focused on performance testing of APIs and distributed systems.
• Hands‑on experience designing and running load, stress and soak tests as code with tools such as Gatling, JMeter or k6.
• Ability to model realistic workloads and interpret results: percentiles, throughput, saturation and resource use.
• Experience diagnosing performance problems with APM, metrics, logs and traces, and explaining findings clearly to engineers.
• Practical security testing experience against the OWASP Top 10 and OWASP API Security Top 10, using tools such as OWASP ZAP or Burp Suite.
• Strong Java skills (or another JVM language) and hands‑on REST Assured experience for functional API testing.
• Experience adding non‑functional tests to CI/CD pipelines, with sensible thresholds that don't create noise.
• Comfortable in a fast‑moving startup environment, balancing speed with the rigour needed when testing financial systems.
• Willing and able to be in our London office four days per week.

Desirable

• Experience in fintech, payments or another regulated financial services environment, and awareness of operational resilience expectations (e.g. FCA rules, DORA).
• Fuzz testing and chaos or fault‑injection tools (e.g. Toxiproxy, Chaos Mesh).
• Security certifications such as OSCP or eWPT, or a background in application security.
• Pact contract testing.
• Mobile performance and security testing (e.g. OWASP MASVS).
• Cloud and container experience (AWS or GCP, Docker, Kubernetes), especially running load tests at scale.

Working at Hyperlayer

At Hyperlayer we are proud of our in‑office culture. It makes a real difference to the working atmosphere and maximises collaboration in and across teams. This is critical to how we work and learn. Also, we think it makes for a great workplace!

We value our team and are proud to offer some great benefits:

• A performance‑based employee bonus scheme.
• 25 days annual leave plus bank holidays, a day off on your birthday, and an additional day per year of tenure to a maximum of 30.
• Critical illness and life insurance cover.
• AXA PPP Health Insurance, including gym offers.
• Cycle‑to‑work scheme.
• Referral bonus scheme.
• Workplace nursery scheme.

Equity, diversity, and inclusion

Hyperlayer's mission is to make a positive impact on people's lives, making it easier for everyone to manage their money.

Hyperlayer's commitment to equity, diversity, and inclusion is a key part of this; it helps us better serve our customers, employees, and business partners from every background.

We are constantly learning and striving to do better, and we expect all staff to actively take part in this process.

Data Privacy

As part of our recruitment process, Hyperlayer Limited collects and processes personal data relating to job applicants.

We are committed to being transparent about how we collect and use this data and to meeting our data protection obligations. To read more click here.