2 months ago
Remote, IndiaMid Level
Responsibilities
- Own the security review process for new SaaS applications, integrations, APIs, plugins, and automation platforms.
- Assess architecture, data flows, trust boundaries, OAuth scopes, tokens, service accounts, webhooks, extensions, marketplace apps, and third-party access.
- Develop threat models, secure design patterns, review checklists, and remediation guidance for integrations and internal tools.
- Review Python, JavaScript, shell, and low-code/no-code automations for secrets handling, injection risks, unsafe data processing, and excessive permissions.
- Build or use automated checks to detect exposed secrets, insecure configurations, and permission risks.
- Conduct vendor and third-party security assessments, including review of security questionnaires, SOC 2 reports, penetration-test summaries, sub-processors, and contractual requirements.
- Monitor SaaS environments for suspicious activity, unauthorized integrations, and data-leakage risks.
- Participate as an L2 incident responder and lead incidents through identification, containment, eradication, recovery, and lessons learned.
- Support SOC investigations involving SIEM investigations, platform behavior, detection logic, and operational troubleshooting.
- Translate incident learnings into improved detections, dashboards, and playbooks.
Requirements
- At least 3 years of experience in SaaS security, application security, cloud security, or a related defensive security role.
- Experience conducting technical security reviews, risk-based threat modeling, and third-party integration and vendor-risk assessments.
- Experience validating security findings and driving remediation with engineering and business teams.
- Strong understanding of least privilege, defense in depth, trust-boundary analysis, OAuth, SAML, OIDC, SSO, and MFA.
- Knowledge of integration risks including excessive permissions, cross-tenant exposure, insecure data flows, injection, credential exposure, and supply-chain compromise.
- Working knowledge of OWASP, MITRE ATT&CK, NIST, or CIS Controls.
- Ability to review Python, JavaScript, or shell scripts for security weaknesses and understand secure API design, secrets management, and short-lived credentials.
- Hands-on experience securing Okta, Google Workspace, and Google Cloud Platform, plus collaboration and SaaS tools such as Linear, Slack, Notion, Intercom, and Atlassian Jira and Confluence.
- Practical incident-response experience covering triage, investigation, containment, and communications.
- Experience with vulnerability management, security-controls implementation, and vendor or third-party security assessments.
- A bachelor's degree in Computer Science, Information Security, or a related field is a plus; equivalent work experience will be considered.
- CompTIA Security+, CySA+, CCSP, OSCP, or GWAPT certifications are advantageous.
- Strong analytical, problem-solving, communication, crisis-management, and multitasking abilities.
Benefits
- Competitive salary package and equity package, including a pay-for-performance equity bonus.
- Employer pension contributions from day one.
- Flexible time off, birthday leave, enhanced parental leave, private healthcare, and Wellhub wellness membership.
- The posting states the role is in-office five days per week in Bengaluru, India, although it also describes company-wide remote and hybrid work options.
- Commuter benefits, lunch credit on office days, home-office setup allowance, and remote-working allowance for fully remote employees.
- Unlimited enterprise access to Claude, ChatGPT, Gemini, and other AI tools.
- Monthly product budget, zero-fee crypto transactions, and a $1,000 annual training budget.
- High Potential Program, mentorship, development opportunities, regular remote company offsites, and hackathons.
- Employee referral program, commuter benefits, and applicable Ireland and UK programs.
Tech Stack
Categories
About MoonPay
MoonPay builds crypto payment infrastructure for consumers and businesses, offering fiat on- and off-ramps, stablecoin tools, and APIs/SDKs for checkout and wallets. Users can buy, sell, and transfer digital assets using cards, Apple Pay, PayPal, and Venmo, with built-in KYC/AML and licensing in the U.S., UK, EU, Canada, and Australia. Founded in 2018 and privately held, the company operates remotely and powers integrations for many Web3 and fintech products.