Flywire—Senior Security Engineer (Defensive)

Job description

Description: Are you ready to trade your job for a journey? Become a FlyMate! Passion, excitement & global collaboration are all core to what it means to be a FlyMate. At Flywire, we’re on a mission to deliver the world’s most important and complex payments. We use our Flywire Advantage - the combination of our next-gen payments platform, proprietary payment network and vertical specific software, to help our clients get paid, and help their customers pay with ease - no matter where they are in the world. What more do we need to truly be unstoppable? Perhaps, that is you! Who we are: Flywire is a global payments enablement and software company, founded more than a decade ago to solve high-stakes, high-value payments. We’ve scaled into new regions and industry verticals and expanded our product offerings to deliver meaningful value to our clients around the world. Today we support more than 5,300 clients across the global education, healthcare, travel & B2B industries, with diverse payment methods across 240 countries & territories and more than 140 currencies. With over 1,400+ global FlyMates, representing more than 40 nationalities, and in 15 offices world-wide, we’re looking for FlyMates to join the next stage of our journey as we continue to grow. Job Summary As a Senior Security Engineer on the Defensive Platform Builder track you will act as a technical authority for secure software design and cloud native infrastructure defence across Flywire's global footprint. You will bring an automation first mindset to a high velocity fintech environment, partnering with software engineering and SRE squads to embed security controls directly into our public cloud and GitLab CI/CD pipelines using AI workflows, so that our global payment systems stay secure by design and resilient in production. Responsibilities and Tasks: 1. Secure SDLC & CI/CD Automation Ownership - Own, design and drive the end to end integration of automated security requirements and validation tooling into high velocity engineering pipelines. - Build custom internal tooling, wrappers and automated controls to replace manual security checkpoints, protecting development velocity while removing friction. 2. Cloud & Infrastructure Hardening - Partner directly with SRE and DevOps teams to establish secure public cloud architecture blueprints, manage Infrastructure as Code security scanning (for example Terraform) and enforce strict network isolation. - Architect and maintain cloud Identity and Access Management controls and enforce Zero Trust boundaries within containerised environments such as Docker and Kubernetes. 3. AI Driven Security & Application Reviews - Design, prompt engineer and deploy automated security review workflows using LLM APIs to run real time code analysis and give context aware feedback on pull requests. - Establish and enforce technical controls that protect internal and external generative AI features against LLM specific risks, including prompt injection, insecure output handling, model inversion and data poisoning. - Run deep dive source code audits and API security reviews that go beyond automated scanning, surfacing complex logic flaws before they reach production. 4. Cross Functional Collaboration & Technical Mentorship - Embed within software development and infrastructure sprint planning from the inception phase so that security is built in from day one rather than bolted on. - Provide expert level, actionable code and configuration guidance directly to software and SRE engineers. - Mentor junior security, software and SRE engineers to raise technical resilience across the wider organisation. - Education: Bachelor's degree required in Computer Science, Cyber Security, Software Engineering or a related technical discipline. A Master's degree is preferred. - Core Experience: indicative range [5 to 8 years] of progressive engineering experience across Application Security and Cloud Architecture Defence. - Advanced Defensive Depth: a proven track record of independently running deep manual code and configuration reviews rather than relying solely on commercial automated scanning platforms. - Cloud & DevOps Engineering Stack: deep practical knowledge of AWS or similar public cloud topologies, containerisation and orchestration (Docker, Kubernetes), network security controls and high velocity GitLab CI pipelines. - Technical Language Depth: solid proficiency with modern web development frameworks and languages including Python, Ruby on Rails, Java and Node.js. - AI & Cryptographic Domain Mastery: expert level understanding of the OWASP Top 10 for LLMs, prompt engineering wrappers, applied cryptography, cloud network isolation and federated authentication architectures (OAuth2, SAML, OIDC, Zero Trust IAM). - Regulatory & Compliance Competency: practical experience aligning technical software and infrastructure controls with standards such as PCI-DSS (v4.0), SOC 1, SOC 2 and DORA. Highly Preferred Certifications - Cloud & Architecture: AWS Certified Security - Specialty, Certified Kubernetes Security Specialist (CKS) or CISSP. - Modern AI Security: OffSec OSAI (Offensive Security AI Red Teamer). - Broader Depth: OSCP or GCIH, where candidates bring exposure to offensive or incident response work as a secondary strength. Skills and Abilities - Balances a builder's engineering empathy with a security first mindset, treating software, SRE and product teams as operational allies rather than a source of friction. - Communicates clearly under pressure, able to distill cloud configuration drift or a live vulnerability into a plain, high impact risk summary for non-technical stakeholders. - Shows creative, novel problem solving across complex, non-standard application and cloud infrastructure challenges within a distributed financial microservices environment. - Resilience and analytical clarity in high-pressure scenarios, with the ability to manage transparency and guide risk-based decisions during active security incidents or compressed financial product launch windows. - Balances technical risk reduction with business enablement, ensuring security infrastructure serves as a competitive advantage that unblocks global revenue and enterprise-client acquisition. What We Offer: - Competitive compensation - Employee Stock Purchase Plan (ESPP) - Competitive time off, including Digital Disconnect and FlyBetter Days to volunteer in a cause you believe in. - Flying Start - Our immersive Global Induction Program (Meet our Execs & Global Teams) - Work with brilliant people globally Learn more about their journeys by checking out #InsideFlywire on social media - Wellbeing Programs (Mental Health, Wellness, Yoga/Pilates/HIIT Classes) with Global FlyMates - Be a meaningful part in our success - every FlyMate makes an impact - Great Talent & Development Programs (Managers Taking Flight – for new or aspiring managers, OneFlywire Career Mobility) Submit today and get started! We are excited to get to know you! Throughout our process you can expect to meet with different FlyMates including the Hiring Manager, Peers on the team, the VP of the department, and a skills assessment. Your Talent Acquisition Partner will walk you through the steps and be your “go-to” person for any questions. #LI-Hybrid