security engineer in payments

payabl. develops payment products, including card issuing, embedded finance, banking-as-a-service, and other fintech solutions.

• Design and introduce security gates into the development lifecycle, embedding secure release practices and guardrails into software development and deployment;
• Lead threat modelling for new products and major changes;
• Provide secure-by-design input for new product builds across card issuing, embedded finance, banking-as-a-service, and other payment products;
• Define secure-by-default application architecture patterns for authentication, authorization, API design, and service-to-service trust;
• Decide where traditional security tooling is appropriate and where AI-assisted alternatives provide better coverage or efficiency;
• Own CI/CD pipeline and software supply-chain security controls across engineering teams;
• Implement and improve container image scanning, dependency management, software bills of materials, and security checks for infrastructure-as-code and deployment manifests;
• Build the product security practice AI-first by introducing AI agents and LLM-assisted workflows as the default delivery mechanism;
• Drive remediation of application-layer findings with engineering teams, including findings from penetration tests, scanners, and disclosure reports.

• 5+ Years of experience in Product Security or Application Security in payments, fintech, banking, e-money, or another fintech product environment;
• Strong hands-on experience embedding security into the software development lifecycle;
• Ability to read code comfortably and contribute to design discussions with senior engineers;
• Proven experience with threat modelling, secure-by-design reviews, and collaboration with engineers during architecture and delivery stages;
• Hands-on experience with application security tooling such as SAST, SCA, secrets detection, and DAST;
• Hands-on experience securing cloud-native applications on AWS or other major cloud platforms;
• Strong AI proficiency and hands-on experience with agentic workflows and loops, RAG, MCP, and related technologies;
• Solid understanding of cloud-first environments and modern development practices;
• Experience securing CI/CD pipelines and improving software supply-chain security;
• Ability to work directly with engineering teams and influence secure delivery in practice, not only through policy;
• Strong ownership mindset with the ability to define, implement, improve, and drive adoption of security practices across multiple teams;
• Strong written and verbal English;
• Nice to have: Experience supporting new product launches in cloud-native or API-driven environments, detection-as-code or security-as-code mindset, penetration-testing or offensive-security background, certifications such as CISSP, CSSLP, CCSP, OSCP, or similar.

• Location: Limassol, Cyprus, or relocation to Cyprus;
• Relocation to Cyprus is available;
• Provident Fund after probation;
• Annual learning budget after probation;
• €150 Monthly Wolt allowance;
• SportsBenefits membership;
• Potential company car after one year, subject to performance and availability;
• Complimentary parking space;
• 25 Days of vacation, public holidays, and 10 days of sick leave;
• Local discount card and event tickets;
• Free Greek language classes twice a week;
• International company events and initiatives;
• Benefits and contract type depend on location and are discussed during the first interview.