Application Security Engineer

At Altery, we're building products that make finance feel seamless in a fragmented world. We build the technology that helps businesses and people move money across borders, currencies and digital assets, without the friction.
Behind every simple payment is a complex system, and a team that makes it work. We look for people who enjoy solving difficult problems, challenge each other with respect and care about doing great work.
We're now looking for an Application Security Engineer to join our Cybersecurity team. You'll make security part of how we build: finding real vulnerabilities in our web, API and mobile products and helping our engineers fix them before they reach customers. Must-haves

• 2+ years as an Application Security Engineer, with a strong understanding of modern web and mobile architecture, including microservices, containers, CI/CD and Secure SDLC principles.
• Hands-on experience building security checks into CI/CD pipelines: SAST, DAST, SCA, secret detection, container image scanning and security gates.
• Experience triaging findings from scanners and Bug Bounty, including manual validation, exploitability assessment, PoCs and communicating fixes to developers.
• Solid web and API security testing skills beyond the OWASP Top 10, covering CSP and security headers, cookies and business logic flaws, and confidence with common proxy and testing tools.
• Mobile application security testing based on OWASP MASVS/MASTG, including root and emulator detection, SSL pinning and anti-tampering.
• Experience in threat modelling and security review of architecture decisions and new features.
• Practical knowledge of software supply chain security and secrets management.
• Fluent English for technical reading, writing and communication.

Nice to have

• A fintech or payments background, including PSD2/SCA, cardholder data and PIN protection, and awareness of PCI DSS.
• Experience running or supporting a Bug Bounty programme, or taking part in one as a researcher.
• Experience using AI and LLM tools in AppSec, such as AI-assisted triage or AI pentest frameworks, and an understanding of AI integration risks.
• Cloud security basics, ideally on AWS.
• Experience with ELK, including security dashboards and metrics and detecting sensitive data in logs.
• Experience with Security Champions programmes, secure coding checklists or developer training.
• Scripting skills for automation and data analysis, and a good understanding of TCP/IP and core network and web protocols.

How you work

• You take ownership: you follow a finding through to a real fix rather than just raising a ticket.
• You collaborate: you work with engineers as partners, share early and help them build security into their own work.
• You're curious: you like to learn, experiment and use AI and automation thoughtfully.

• Own security findings end to end: triage results from scanners and our Bug Bounty programme, validate them manually, assess exploitability and build proofs of concept.
• Work with development teams to explain vulnerabilities clearly and help them fix the root cause, not just the symptom.
• Help build and improve our Secure SDLC, embedding SAST, DAST, SCA, secret detection, container image scanning and security gates into our CI/CD pipelines.
• Review application architectures and new features through threat modelling, and turn the results into clear security requirements for our products.
• Test our web, API and mobile applications dynamically, with a focus on the business logic flaws that scanners miss.
• Strengthen our software supply chain and secrets management, from dependency control to secrets detection and rotation.
• Report monthly on our application security posture, so the team can see what's improving and where to focus next.

Here's what you can expect when you join Altery:

• Competitive compensation that rewards your contribution.
• Flexible working. Wherever you are, you work your local hours with flexibility, and we all come together during core hours, 9am-2pm UK time. Near a hub? We'd love to see you from time to time, but we care more about outcomes than office hours.
• Wellbeing support, including additional sick leave when you need it.
• Opportunities to grow your career by taking ownership, expanding your skills and making a real impact.

Why join us

• A team that has your back: we're team players, not solo stars. People here are quick to help and ready to collaborate.
• Ownership from day one: you're trusted to make decisions, try new things and lead from wherever you are.
• Built by a global team: our team spans countries, cultures and time zones, and those different perspectives help us build for customers around the world.
• High standards, continuous growth: you'll be encouraged to learn, challenge assumptions and help raise the bar.
• Resilient by design: we're a startup, so we don't expect easy days, we expect progress. When challenges come, you'll never face them alone.

Sound like you? Apply now and help us create financial experiences that work seamlessly across borders, currencies and technologies.
We celebrate our diversity: its power strengthens our team. We welcome applications from everyone, whatever your background, and we hire based on skills, experience and the difference you can make.
We treat your personal data with care and use it only for recruitment. Applications are processed through our hiring platform, HiBob. To find out how your data is handled, read the Bob Hiring privacy notice.