MoonPay is a unified payments platform for digital currency, dedicated to onboarding the world to the decentralized economy. We make it easy for anyone, anywhere, to buy, sell, swap, and pay in digital currencies, reducing complexity so people can participate confidently. Our platform powers the entire flow between fiat and crypto end-to-end, with built-in compliance, identity checks, fraud prevention, and settlement. Trusted by over 30 million customers and 500+ ecosystem partners, we are driving mainstream crypto adoption worldwide. We are fully licensed in the U.S. and regulated across the UK, EU, Canada, and Australia, prioritizing trust and compliance. With a fast-growing consumer app, we are committed to building a fairer, more open financial system and invite passionate individuals to join us in shaping the future of payments and the decentralized economy.

About the Position

Introduction

MoonPay is seeking a highly skilled and passionate Senior Security Engineer specializing in Automation to join our Product Security Squad. In this hybrid role based in New York, you will play a crucial part in fortifying our systems by designing, implementing, and managing cutting-edge security automation solutions. You will champion vulnerability management, integrate security tools into CI/CD pipelines, and contribute to a secure and resilient environment as we build the future of payments in the decentralized economy.

Responsibilities

Design, implement, and manage the integration of security tooling (SAST, DAST, SCA, Secrets Scanning) into CI/CD pipelines.
Develop and maintain automation scripts and platforms to streamline security processes and workflows.
Own and operate the end-to-end vulnerability management lifecycle: identification, triage, prioritization, distribution, tracking, and reporting.
Collaborate closely with engineering teams to ensure timely remediation of identified vulnerabilities and provide guidance on secure coding practices.
Drive the adoption and implementation of the SLSA framework to enhance supply chain security.
Continuously evaluate and improve existing security automation and vulnerability management workflows, bringing innovation and ownership to the process.
Research emerging threats and vulnerabilities, particularly those relevant to our tech stack and development practices, translating findings into actionable detection or prevention mechanisms.
Develop and maintain documentation for security automation tools, processes, and vulnerability management procedures.
Assist in triaging and validating findings from various sources, including automated scanners, penetration tests, and bug bounty programs.
Contribute to security training materials focused on secure development practices and the tools you implement.
Support incident response activities, particularly where automation or vulnerability data can aid investigation and remediation.
Champion and execute the security team's automation strategy for cross-functional needs, actively seeking and implementing automation opportunities based on team feedback.
Collaborate closely with Application Security and Cloud Security teams to translate their operational needs into actionable automation requirements, taking ownership of implementing related security initiatives.

Requirements

Solid background in software development with demonstrable experience, ideally using languages common in backend or infrastructure development (e.g., Go, Python, Node.js).
Strong passion for cybersecurity and a keen interest in security automation and vulnerability management.
Understanding of security tools like SAST, DAST, SCA, and secrets scanning solutions within a CI/CD environment (experience with GitHub preferred).
Understanding of the principles of vulnerability management, including prioritization frameworks (e.g., CVSS) and remediation tracking.
Familiarity with the concepts and goals of the SLSA framework or similar supply chain security initiatives.
Excellent collaboration skills, with the ability to clearly explain security concepts and tooling requirements to technical teams and drive adoption of new processes.
Strong analytical and problem-solving skills, with an ability to identify inefficiencies and propose automated solutions.
Self-motivated, innovative, takes ownership of work, and can operate effectively in a fast-paced environment.

Nice to Have

Experience working in disruptive technology, FinTech, SaaS, or Crypto sectors.
Familiarity with cloud security principles (AWS, GCP).
Deep understanding of GitHub's functionalities, including advanced features, security settings, and API capabilities.
Strong administrative skills in managing and maintaining GitHub Enterprise environments (user access, repository management, organization settings).
Familiarity with GitHub Actions for workflow automation and security enforcement.

Benefits

Competitive salary package
Equity package: All employees have ownership at MoonPay.
Pay for performance equity bonus: Outsized rewards for outsized outcomes.
Moonshot award: Exceptional impact recognized with a $250,000 equity grant for 10 employees twice a year.
Unlimited holidays: Autonomy to choose when to work and when to switch off.
Hybrid working schedule: Work fully remotely or at your nearest Moonbase.
Private Healthcare benefits for you and your loved ones.
Enhanced parental leave.
Annual training budget.
Home office setup allowance.
Remote working allowance for fully remote employees.
Monthly budget for MoonPay products and zero-fee crypto transactions.
Employee referral program: Refer great people to receive 10K in USDC.
Regular remote company offsites for in-person sessions and hackathons.
Opportunity to work in a disruptive and fast-growing company where excellence is rewarded.