At Altery, we're building products that make finance feel seamless in a fragmented world. We build the technology that helps businesses and people move money across borders, currencies and digital assets, without the friction. Behind every simple payment is a complex system, and a team that makes it work. We look for people who enjoy solving difficult problems, challenge each other with respect and care about doing great work. We're now looking for an Application Security Engineer to join our Cybersecurity team. You'll make security part of how we build: finding real vulnerabilities in our web, API and mobile products and helping our engineers fix them before they reach customers. 2+ years as an Application Security Engineer, with a strong understanding of modern web and mobile architecture, including microservices, containers, CI/CD and Secure SDLC principles. ~ Hands-on experience building security checks into CI/CD pipelines: SAST, DAST, SCA, secret detection, container image scanning and security gates. ~ Mobile application security testing based on OWASP MASVS/MASTG, including root and emulator detection, SSL pinning and anti-tampering. ~ Experience in threat modelling and security review of architecture decisions and new features. ~ Practical knowledge of software supply chain security and secrets management. ~ Fluent English for technical reading, writing and communication. A fintech or payments background, including PSD2/SCA, cardholder data and PIN protection, and awareness of PCI DSS. Cloud security basics, ideally on AWS. Experience with ELK, including security dashboards and metrics and detecting sensitive data in logs. Experience with Security Champions programmes, secure coding checklists or developer training.



Scripting skills for automation and data analysis, and a good understanding of TCP/IP and core network and web protocols. You collaborate: you work with engineers as partners, share early and help them build security into their own work. Own security findings end to end: triage results from scanners and our Bug Bounty programme, validate them manually, assess exploitability and build proofs of concept. Help build and improve our Secure SDLC, embedding SAST, DAST, SCA, secret detection, container image scanning and security gates into our CI/CD pipelines. Review application architectures and new features through threat modelling, and turn the results into clear security requirements for our products. Test our web, API and mobile applications dynamically, with a focus on the business logic flaws that scanners miss. Strengthen our software supply chain and secrets management, from dependency control to secrets detection and rotation. Report monthly on our application security posture, so the team can see what's improving and where to focus next. Versátil working. Wherever you are, you work your local hours with flexibility, and we all come together during core hours, 9am-2pm UK time. We'd love to see you from time to time, but we care more about outcomes than office hours. Wellbeing support, including additional sick leave when you need it. Built by a global team: our team spans countries, cultures and time zones, and those different perspectives help us build for customers around the world. Resilient by design: we're a startup, so we don't expect easy days, we expect progress. We treat your personal data with care and use it only for recruitment. To find out how your data is handled, read the Bob Hiring privacy notice. #

📌 Security Applications Engineer (Ceuta)
🏢 Altery
📍 Ceuta