Senior Application Security Engineer

About the role

Moniepoint Inc. is looking for a Senior Application Security Engineer to embed security throughout its software development lifecycle. You will partner with engineering teams to protect customer data while they build innovative fintech services.

Key responsibilities

• Define and execute security strategy for product teams, aligning with business goals.
• Lead threat‑modeling sessions, security architecture reviews, and provide design guidance.
• Mentor engineers and foster a culture of security excellence.
• Conduct adversarial security analysis using automated tools and custom exploit development.
• Perform manual and automated secure code reviews for Java, Python, JavaScript and cloud‑native stacks.
• Develop and enhance security automation tools (SAST/DAST/IAST) to scale vulnerability detection.
• Identify complex risks through offensive research and champion cutting‑edge mitigation technologies.
• Maintain and evolve threat models for critical applications and micro‑services.
• Integrate security controls into CI/CD pipelines and development practices.
• Design and deliver security training for developers and business stakeholders.
• Lead incident response for application security events and drive root‑cause analysis.

Required profile

• 5+ years of experience in application security, including at least 2 years in a senior or lead role.
• Proven technical leadership with the ability to influence engineers and executives.
• Deep knowledge of threat modeling (e.g., STRIDE, PASTA), penetration testing, and secure SDLC implementation.
• Strong communication skills to translate complex risks into actionable guidance.
• Experience mentoring engineers and building security‑first cultures.

Required skills

• Threat modeling (STRIDE, PASTA)
• Penetration testing and exploit development
• Secure software development lifecycle (SDLC)
• Secure code review for Java, Python, JavaScript
• Cloud platforms (AWS, Azure, GCP or similar)
• SAST, DAST, IAST tooling
• CI/CD pipeline security integration
• Security automation and scripting
• Incident response and root‑cause analysis