Application Security Engineer (X Money)

• We are seeking a skilled and innovative Application Security Engineer to join 𝕏 Money
• In this role, you will protect the security and integrity of our payments and financial products throughout the software development lifecycle, with a particular focus on code security, CI/CD pipelines, and systems that move and hold customer funds
• Experience securing fintech, payments, digital wallet, ledger, or similar high-value platforms, where fraud, abuse, and unauthorized transfers are a constant concern, is strongly preferred
• Conduct in-depth code reviews and static analysis to identify and mitigate security vulnerabilities in financial applications
• Design and implement secure coding guidelines and best practices for development teams
• Collaborate closely with development teams to integrate security practices throughout the CI/CD pipeline
• Perform threat modeling and risk assessments for payments, wallets, ledgers, and related product surfaces, and develop mitigation strategies for fraud, abuse, and unauthorized movement of funds or credits
• Manage vulnerability tracking and remediation efforts, providing guidance to development teams
• Manage the bug bounty program, including intake, triage, researcher communication, and coordinated disclosure
• Support incident response activities related to application security
• Stay current on emerging threats against financial and cloud-native systems, and continuously strengthen our controls
• Evaluate and secure software supply chains, including producing and maintaining Software Bills of Materials (SBOMs)
• Design and implement agentic and LLM-based solutions that help detect, investigate, or prevent security problems

Benefits

• Health and wellness: Comprehensive health insurance including medical, dental, vision, and disability coverage
• Life and family: Life and AD&D insurance and fertility benefits to ensure our team’s well-being and peace of mind
• Flexible vacation: We work hard but avoid burn out. Take time off when you need it
• Visa sponsorship: We support international talent with visa sponsorship to join our team
• 401(k) plan: Retirement savings plan to secure your financial future

• Familiarity with software supply chain security and SBOM generation tools
• Experience with security testing tools (e.g., Burp Suite, OWASP ZAP) and static/dynamic code analysis
• Experience in payments, money transmission, digital wallets, or related financial platforms
• Experience designing and implementing agentic and LLM-based solutions for security problems
• Deep understanding of secure coding practices, application security frameworks, and common vulnerabilities (e.g., OWASP Top 10)
• Bachelor’s degree in Computer Science, Cybersecurity, or a related field
• Experience securing CI/CD pipelines and implementing DevSecOps practices
• Excellent communication skills, able to explain complex security issues to both technical and non-technical audiences
• Experience securing payments, wallets, ledgers, or other high-value transaction systems, including controls against fraud, abuse, and integrity issues
• Proficiency in Python or Rust and experience with secure coding practices in these languages
• 3-5 years of experience in application security, with a strong focus on code security practices
• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State
• Experience managing bug bounty programs
• Contributions to open-source security projects or tools
• Experience with GitOps and infrastructure-as-code security
• Background in data privacy and compliance relevant to financial products and cloud-native applications
• Experience building custom security tooling to enhance and automate security processes
• Relevant security certifications (e.g., BSCP, OSCP, OSWE)
• Hands-on experience securing applications on AWS; familiarity with other cloud platforms is a plus