AI-Enhanced AppSec & Cloud Security Engineer (Fintech)

IPAYAPP s.r.o.; Województwo mazowieckie; Hybrid; PLN 120,000 - 190,000; Full time

Job summary

iPay is hiring an Information Security Engineer to be the first dedicated security specialist on the team. You will build threat models, review architecture and code, and organize internal and external penetration tests to protect live crypto and payments services.

You will own PCI DSS scope, data segmentation, audits, and custody/security controls for keys and wallets across Google Cloud and Kubernetes. Knowledge of OWASP and secure software supply chains is essential.

Qualifications

• 3+ years in AppSec or Cloud Security, fintech preferred.
• Hands-on experience using AI tools for code/config analysis.
• Knowledge of OWASP ASVS and OWASP Top 10.
• Experience securing Kubernetes and cloud platforms (GCP/AWS).
• Experience with PCI DSS audits.
• English able to read technical documents.

Responsibilities

• Threat modeling, architecture and source code reviews, organizing internal and external penetration tests.
• PCI DSS compliance: defining the scope, segmentation, audit preparation.
• Custody security: transaction signing policies (co-signer), key and wallet access management.
• Software supply chain security: dependency control, image scanning and signing, cluster admission policies.
• Cloud and Kubernetes security: IAM, network policies, service mesh policies, secrets management, auditing and logging.
• Mobile app security: certificate pinning, device integrity checks, secure storage of secrets.
• Fraud and account takeover prevention, security incident investigations.
• Audit readiness (PCI DSS, ISO 27001 or SOC 2), security policies and procedures, staff training.

Skills

AppSec

Cloud security

Threat modeling

Code review

Kubernetes security

AI tooling

PCI DSS knowledge

Tools

Kubernetes

GCP

AWS

OWASP ASVS

CI/CD security tooling

Job description

iPay is hiring an Information Security Engineer to be the first dedicated security specialist on the team. You will build threat models, review architecture and code, and organize internal and external penetration tests to protect live crypto and payments services.

You will own PCI DSS scope, data segmentation, audits, and custody/security controls for keys and wallets across Google Cloud and Kubernetes. Knowledge of OWASP and secure software supply chains is essential.