Remote Lead App Security Engineer - Fintech

Reap; Hong Kong; On-site; HKD 600,000 - 900,000; Full time

Benefits offered by this job

Flexible remote work options

Home office equipment budget

Job summary

Reap is seeking an Application Security Engineer to embed security within the engineering process and own the secure SDLC. You will build tooling, run threat modelling sessions, and manage the bug bounty program as the team grows.

This builder role works inside the engineering team, collaborating with Risk, Operations, and Engineering to keep payments safe and scalable while supporting global operations and flexible remote work.

Qualifications

• Experience building and owning a secure SDLC.
• Hands-on security tooling in CI/CD pipelines.
• Ability to run threat modelling with engineers.
• Knowledge of PCI DSS requirements for payment environments.

Responsibilities

• Build and own the application security programme in CI/CD.
• Lead threat modelling for new product features and API integrations.
• Do security-focused code reviews for auth, payments, and APIs.
• Own dependency and OSS security program and policies.
• Run developer security education sessions (OWASP Top 10).
• Manage penetration testing engagements end-to-end.

Skills

SAST/DAST/SCA pipeline

Threat modelling

Secure code review

OWASP Top 10 / API Top 10

Penetration testing fundamentals

PCI DSS secure coding

CI/CD tooling

Secure coding in JS/TS

Python/Go/Rust security

Education

CSSLP, GWEB, or OSCP

Tools

Semgrep

CodeQL

Checkmarx

SonarQube

Job description

Reap is seeking an Application Security Engineer to embed security within the engineering process and own the secure SDLC. You will build tooling, run threat modelling sessions, and manage the bug bounty program as the team grows.

This builder role works inside the engineering team, collaborating with Risk, Operations, and Engineering to keep payments safe and scalable while supporting global operations and flexible remote work.