Information Security Engineer (AppSec / Cloud Security)

IPAYAPP s.r.o.; Województwo mazowieckie; Hybrid; PLN 120,000 - 190,000; Full time

Job summary

iPay is hiring an Information Security Engineer to be the first dedicated security specialist on the team. You will build threat models, review architecture and code, and organize internal and external penetration tests to protect live crypto and payments services.

You will own PCI DSS scope, data segmentation, audits, and custody/security controls for keys and wallets across Google Cloud and Kubernetes. Knowledge of OWASP and secure software supply chains is essential.

Qualifications

• 3+ years in AppSec or Cloud Security, fintech preferred.
• Hands-on experience using AI tools for code/config analysis.
• Knowledge of OWASP ASVS and OWASP Top 10.
• Experience securing Kubernetes and cloud platforms (GCP/AWS).
• Experience with PCI DSS audits.
• English able to read technical documents.

Responsibilities

• Threat modeling, architecture and source code reviews, organizing internal and external penetration tests.
• PCI DSS compliance: defining the scope, segmentation, audit preparation.
• Custody security: transaction signing policies (co-signer), key and wallet access management.
• Software supply chain security: dependency control, image scanning and signing, cluster admission policies.
• Cloud and Kubernetes security: IAM, network policies, service mesh policies, secrets management, auditing and logging.
• Mobile app security: certificate pinning, device integrity checks, secure storage of secrets.
• Fraud and account takeover prevention, security incident investigations.
• Audit readiness (PCI DSS, ISO 27001 or SOC 2), security policies and procedures, staff training.

Skills

AppSec

Cloud security

Threat modeling

Code review

Kubernetes security

AI tooling

PCI DSS knowledge

Tools

Kubernetes

GCP

AWS

OWASP ASVS

CI/CD security tooling

Job description

iPay is looking for an Information Security Engineer — the first dedicated security specialist on the team. The platform safeguards customers’ crypto assets and issues payment cards, which calls for comprehensive protection at every level, from source code to cloud infrastructure.

About iPay

iPay is a fintech platform in the neobank space that brings crypto and fiat together: a multi-currency wallet, exchange, payment card issuing, transfers, SEPA payments and an API for partners. The platform is live in production and serves several partner companies under their own brands (white label).

Platform architecture

• around 15 TypeScript (Node.js) microservices communicating over gRPC, each with its own PostgreSQL database;
• an in-house double-entry ledger: every money movement is posted and reconciled against provider data;
• event-driven communication via the transactional outbox pattern and Apache Kafka; integrations with external providers run on idempotent webhooks;
• integrations with an MPC custody provider, card issuers, a KYC/KYT provider and exchange venues;
• infrastructure on Google Cloud: Kubernetes, GitOps, service mesh;
• a React Native (Expo) mobile app, a web client and an admin panel built with React.

Responsibilities

• Threat modeling, architecture and source code reviews, organizing internal and external penetration tests.
• PCI DSS compliance: defining the scope (card data, including PAN, CVV and PIN, is processed by platform services), segmentation, audit preparation.
• Custody security: transaction signing policies (co-signer), key and wallet access management.
• Software supply chain security: dependency control, image scanning and signing, cluster admission policies.
• Cloud and Kubernetes security: IAM, network policies, service mesh policies, secrets management, auditing and logging.
• Mobile app security: certificate pinning, device integrity checks, secure storage of secrets.
• Fraud and account takeover prevention, security incident investigations.
• Audit readiness (PCI DSS, ISO 27001 or SOC 2), security policies and procedures, staff training.

Requirements

• 3+ years in AppSec or Cloud Security, preferably in fintech.
• Hands-on experience using AI tools (Claude Code, Cursor or similar): code and configuration analysis, automating checks; understanding of the security risks of using AI agents in development.
• Knowledge of OWASP ASVS and OWASP Top 10, experience with threat modeling and code review in TypeScript and Node.js.
• Experience securing Kubernetes and cloud platforms (GCP or AWS).
• Experience with PCI DSS audits or with systems in PCI DSS scope.
• Applied cryptography: TLS, AES-GCM, RSA-OAEP, HMAC, key management.
• English sufficient to read technical documentation.

Nice to have

• Blockchain and custody experience: MPC, transaction signing policies, smart contract audits.
• Mobile application security (iOS, Android).
• Certifications: OSCP, OSWE, CISSP, PCI ISA or QSA.
• Knowledge of AML/KYC and anti-fraud processes.

Tech stack

TypeScript, Node.js, React Native; GCP (GKE, Cloud Armor, Binary Authorization, Secret Manager), Istio, GitHub Actions, Trivy.

What we offer

• Work on a product that is live in production, with real customers and real money movements.
• Work with TypeScript, Node.js, microservices, Kubernetes, GitOps and infrastructure as code.
• Direct influence on product and architecture decisions in a compact team.
• AI tools built into development, code review and testing as part of the everyday workflow.