QA engineer (auto) in application security

Hyperlayer is the intelligent banking platform built for the agentic economy: the financial control layer that sits above banks' existing cores, enabling next-generation Smart Accounts, without ripping anything out. From a single integration, we give financial institutions a secure rules and orchestration engine that lets them design, launch and scale hyper-personalised products in weeks while preserving stability, compliance and control. And there's nothing like us anywhere in the world.

• Test our APIs and apps against the OWASP API Security Top 10 and OWASP Top 10, with a focus on authentication, authorisation and data exposure.
• Make sure one bank can never see or change another bank's data, with automated tenant-isolation checks for every endpoint.
• Test agent-ready accounts: delegated permissions, spending limits, revocation and the audit trail for every agent action.
• Build automated security tests in Java and REST Assured, and turn every confirmed finding into a regression test.
• Add security checks to our CI/CD pipelines, such as DAST (e.g. OWASP ZAP), fuzzing (e.g. ffuf), SAST and dependency scanning, tuned so they don't create noise.
• Join design reviews and threat modelling for new features, and turn abuse cases into test cases.
• Prepare for external penetration tests, triage their findings with engineering, and verify fixes.
• Test HyperJar's mobile security, including secure storage, authentication and API usage, against OWASP MASVS.
• Report security risk clearly to inform release go/no-go decisions.
• Help other quality engineers add security checks to their own pods, using AI tools where they help and

• 5+ years in QA, quality engineering or application security, including at least 3 years of hands-on security testing of APIs and web applications.
• Strong practical knowledge of the OWASP API Security Top 10 and OWASP Top 10, with real findings you can talk about.
• Hands-on experience with security testing tools such as OWASP ZAP or Burp Suite.
• Solid understanding of authentication and authorisation: OAuth 2.0, OpenID Connect, JWT, session handling and role-based access control.
• Strong API testing skills, with experience automating tests in Java (or another JVM language) using REST Assured or similar.
• Experience adding security testing to CI/CD pipelines (e.g. Jenkins, Bitbucket Pipelines, GitHub Actions) and triaging scanner findings.
• Ability to explain risk and severity clearly to engineers and non-specialists.
• Comfortable in a fast-moving startup environment, balancing speed with the rigour needed when testing financial systems.
• Willing and able to be in our London office four days per week.
• Candidates will need an existing non-sponsored right to work in the UK.
• Будет плюсом: Experience in banking, payments or another regulated financial services environment, and awareness of expectations such as FCA rules, DORA or PCI DSS; Security certifications such as OSCP, OSWE, eWPT or CREST, or a background in penetration testing; Threat modelling experience (e.g. STRIDE); Mobile application security testing (OWASP MASVS, MobSF), ideally including Flutter apps; Experience testing multi-tenant SaaS platforms or services written in Go; Awareness of security risks in AI and agent-based systems, such as the OWASP Top 10 for LLM Applications; Cloud and container security experience (AWS, Docker, Kubernetes)

• This role is predominantly office-based in Paddington, London.
• We will not be offering UK work visa sponsorship for these roles.
• At Hyperlayer we are proud of our in-office culture. It makes a real difference to the working atmosphere and maximises collaboration in and across teams. This is critical to how we work and learn. Also, we think it makes for a great workplace!
• A performance-based employee bonus scheme.
• 25 days annual leave plus bank holidays, a day off on your birthday, and an additional day per year of tenure to a maximum of 30.
• Critical illness and life insurance cover.
• AXA PPP Health Insurance, including gym offers.
• Cycle-to-work scheme.
• Referral bonus scheme.
• Workplace nursery scheme.
• Equity, diversity, and inclusion