It's a high-standards, high-velocity, high-accountability company building the operating system for value movement. If the internet moves information, we move value: crypto, stablecoins, tokenized assets, and whatever comes next. AI is the default operating mode here. It handles the manual work so you can deliver on what actually matters.
You'll thrive here if outcomes excite you more than process, if impact motivates you more than titles, and if you want hard problems, real ownership, and teammates who love winning, building, and doing it together.
We're building for what's next, for humans and agents.
The Sunday Times Best Places to Work two years running
Research has shown that women are less likely than men to apply for this role if they do not have experience in 100% of these areas. Skills can be learned, diversity cannot.
Relocation available: This role will be in the office.
On-site 5 days per week.
The Security Operations (SecOps) team at MoonPay is dedicated to ensuring the security and integrity of our systems and data in an increasingly complex digital landscape. Our mission is to identify and mitigate vulnerabilities and threats while maintaining strict compliance with security policies and relevant regulations. By leveraging advanced security measures and proactive threat detection techniques, we work diligently to safeguard our infrastructure and protect our customers' information.
In collaboration with the IT team and other departments, we foster a culture of security awareness, sharing best practices and ensuring that everyone at MoonPay understands their role in maintaining a secure environment.
Our key responsibilities include incident response, security monitoring, endpoint security, VPN, vulnerability management, data leak protection and third-party risk management (TPRM), all of which contribute to our overarching goal: to create a secure environment for our employees, clients and partners.
Join us in our commitment to security excellence and help us build a safer future in the blockchain and payments industry!
We are looking for an Information Security Engineer, SaaS & Integration Security, to join our Information Security team, focused on securing our internal SaaS ecosystem, third-party integrations, APIs, and automation workflows. Assess new applications and integrations before approval, reviewing architecture, data flows, and trust boundaries.
Evaluate OAuth scopes, tokens, service accounts, webhooks, extensions, and marketplace apps for excessive permissions, cross-tenant exposure, and unauthorized access.
Assess AI assistants and third-party AI integrations accessing company systems.
Detects and reduces shadow IT and unsanctioned SaaS-to-SaaS connections.
Facilitate risk-based threat modeling for SaaS apps, integrations, APIs, scripts, and internal tools.




Identify trust boundaries, abuse cases, and sensitive-data exposure; ensure risks have owners, mitigations, and timelines.
Provide secure design alternatives when proposed solutions create unacceptable risk.
Review Python, JavaScript, shell, and low-code/no-code automations for secrets handling, injection risks, unsafe data processing, and excessive permissions.
Build automated checks for exposed secrets and insecure configurations.
Perform targeted testing of integrations, APIs, identity flows, and configurations.

Conduct vendor and third-party security assessments, evaluating risk posture and reviewing security questionnaires.
Assess third-party access to company systems and data, including sub-processor risk.
Reassess vendor risk over time as scope or posture changes.
Partner with Legal and Privacy on contractual security requirements.

Monitor SaaS environments for suspicious activity, unauthorized integrations, and data-leakage risks
Actively participate in Security Operations activities as an L2 Incident Responder.
Describe the ideal candidate's qualifications, skills, experience, and behaviours that show strong culture alignment.
You're an Information Security Engineer who can both build and operate at scale. Apple systems, Google Workspace, Slack, Mimecast Code42, Okta, Crowdstrike, Cloudflare WARP, Tenable Nessus and Jamf Pro.
Must-have Experience And Skills

- Experiences
- 3+ years in SaaS security, application security, cloud security, or a related defensive security role
- Experience conducting technical security reviews and risk-based threat modeling
- Track record of assessing third-party integrations, APIs, and vendor risk before adoption
- Experience validating security findings and driving remediation with engineering/business teams

Cybersecurity Principles
Strong grasp of least privilege, defense in depth, and trust boundary analysis
Familiarity with common integration risks: excessive permissions, cross-tenant exposure, insecure data flows, injection, credential exposure, supply-chain compromise
Ability to read and review scripts in Python, JavaScript, or shell for security weaknesses
Hands-on experience securing identity and productivity platforms such as Okta, Google Workspace, and Google Cloud Platform
Experience assessing security and access controls in collaboration/SaaS tools such as Linear, Slack, Notion, Intercom, and Atlassian (Jira/Confluence)




Comfort building or using automated checks/tooling to detect exposed secrets, misconfigurations, or permission risks across a SaaS-first stack
Nice-to-have Experience

Bachelor's degree in Computer Science, Information Security, or a related field. Equivalent work experience will be considered.
Experience with frameworks such as ISO 27001, SOC 2, and PCI-DSS.
Practical incident response experience including triage, investigation, containment, and communications.
Experience conducting vendor and third-party security assessments, including evaluating risk posture, reviewing security questionnaires, and ensuring third parties meet organizational security standards.

Bonus Points
Optional extras that would help a candidate stand out (keep this short).

Proven experience with tools such as:
Google Workspace / Cloud Platform
Research has shown that women are less likely than men to apply for this role if they do not have experience in 100% of these areas. Skills can be learned, diversity cannot.
Competitive salary package
Equity package: financial freedom starts with our employees, so all employees have ownership at MoonPay
Pay-for-performance equity bonus: those who drive outsized outcomes receive outsized rewards
Pension: employer contributions from day one
Employee referral program: refer great people, earn 10K in USDC
Flexible Time Off: choose when to work and when to switch off
Birthday leave: take the day off to celebrate you
Enhanced parental leave: more time with family, no second thought
Hybrid working schedule: work fully remotely or from your nearest Moonbase
Commuter benefits: public transport to and from the office
Private healthcare benefits: to protect you and your loved ones
Enterprise access to the latest AI tools: Lunch credit: meals covered on the days you're in the office
Home office setup allowance: build the home office of your dreams
Remote working allowance: those working fully remotely get a little extra for utilities
1,000 Annual training budget: we support your learning journey
High Potential Program: structured development, mentorship, and stretch opportunities
Regular remote company offsites: high-impact in-person sessions and hackathons

- Ireland) Cycle to Work scheme: tax-productive bike, gear, and safety kit
- UK) EV Salary Sacrifice: lease an electric vehicle through pre-tax salary

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. If you would like more information about how your data is processed, please contact us.

📌 Information Security Engineer Remote (Bengaluru)
🏢 MoonPay
📍 Bengaluru