- Company Name
- MoonPay
- Job Title
- Application Security Engineer
- Job Description
-
**Job Title:** Application Security Engineer
**Role Summary:**
Execute comprehensive application security activities across the software development lifecycle, including threat modeling, penetration testing, bug‑bounty triage, and application‑layer defense management. Collaborate with engineering to embed secure design principles, provide actionable guidance, and elevate the organization’s security posture.
**Expectations:**
- Deliver timely, practical security recommendations during design reviews.
- Perform white‑box and source‑code‑assisted assessments, vulnerability scans, and proof‑of‑concept exploits.
- Investigate, validate, and drive remediation of bug‑bounty findings.
- Maintain and tune Cloudflare WAF and related application protections.
- Research emerging threats, produce mitigation strategies, and update security standards.
- Lead or support incident‑response activities from investigation to post‑incident review.
**Key Responsibilities:**
- Conduct threat‑modeling reviews of Technical Design Documents and new feature proposals.
- Execute application security assessments (penetration tests, vulnerability scans, PoC development).
- Triage and respond to bug‑bounty submissions, coordinating remediation with engineering.
- Own application‑layer protection controls, including Cloudflare WAF configuration and tuning.
- Partner with development teams to embed security best practices throughout the SDLC.
- Research and monitor new threats/vulnerabilities, translating findings into actionable mitigations.
- Create, maintain, and evolve security standards, processes, and documentation.
- Develop and deliver security training and awareness sessions for engineering staff.
- Participate in incident‑response activities, supporting containment, remediation, and post‑incident improvements.
**Required Skills:**
- Strong threat‑modeling and risk‑analysis capabilities.
- Hands‑on experience with white‑box penetration testing and source‑code review.
- Proficiency in vulnerability scanning tools and PoC development.
- Knowledge of application‑layer defenses, especially Cloudflare WAF and related security controls.
- Experience with bug‑bounty program management and triage.
- Familiarity with SDLC integration of security (CI/CD, DevSecOps).
- Ability to research, document, and communicate security findings to technical and non‑technical audiences.
- Incident‑response knowledge, including investigation, containment, and remediation.
**Required Education & Certifications:**
- Bachelor’s degree (or higher) in Computer Science, Information Security, or related field, or equivalent work experience.
- Professional certifications such as OSCP, CEH, CISSP, GPEN, or equivalent are preferred.
- Demonstrated breadth of experience in web, mobile, infrastructure, and cloud application security.