More visibility, more control, and more freedom. Since ****, Revolut has been on a mission to deliver just that. So far, we have 13,000+ people working around the world, from our offices and remotely, to help us achieve our mission. We're looking for an Application Security Engineer to keep our software safe from threats and vulnerabilities. You'll be designing and building apps with security in mind while testing, monitoring, and protecting our systems along the way.
What you'll be doingPerforming security assessments on product designs, mobile apps (iOS/Android), web applications, and APIsParticipating in Red Team missions and threat-led testing scenarios to simulate real-world attacker behaviours and validate detection and response capabilitiesLeading and conducting penetration testing across applications, infrastructure, and APIs, using a mix of manual techniques and automated toolsManaging and evolving our private bug bounty programme, validating submissions, collaborating with researchers, and ensuring timely resolution of valid findingsContributing to and influencing cloud security posture, identifying misconfigurations and working with DevOps to implement best practices across GCP and AWSPartnering closely with engineering teams to embed security into the software development lifecycle, offering guidance on secure architecture and threat modellingDeveloping and enforcing internal AppSec standards, policies, and practices aligned with OWASP, NIST, and industry benchmarksContinuously researching and evaluating emerging threats, tools, and technologies to stay ahead of the evolving threat landscapeContributing to internal security training sessions, knowledge sharing, and mentoring of junior team membersWhat you'll need3+ years of hands-on experience in application security, penetration testing, or a related security engineering roleA solid understanding of common web, mobile, and API vulnerabilities (e.g., OWASP Top 10, CWE)



and practical approaches to identify and remediate themExperience conducting code reviews, design reviews, and threat modelling for modern application architecturesFamiliarity with DevSecOps practices and integrating security tooling into CI/CD pipelinesWorking knowledge of authentication, authorisation, session management, and cryptographic best practicesProficiency with security tools, such as Burp Suite, MobSF, Frida, or custom scripts, for dynamic and static analysisA basic understanding of cloud security principles and experience working with GCP or AWS environmentsGreat communication skills with the ability to collaborate effectively with Engineering, Product, and DevOps teamsA proactive mindset with a passion for solving complex problems and driving secure engineering practicesThe ability to work independently while also being a trusted team player in a fast-paced environmentNice to haveExperience participating in Red Team exercises, managing bug bounty programmes, or contributing to open-source security tools or researchCompensation rangeKrakow: Compensation will be discussed during the interview process*Final compensation will be determined based on the candidate's qualifications, skills, and previous experienceBuilding a general financial super app isn't enough. We're not just doing this because it's the right thing to do. We're doing it because we know that seeking out diverse talent and creating an inclusive workplace is the way to create exceptional, innovative products and services for our customers. If anyone does ask you for this, it's a scam. Report it immediately.
By submitting this application, I agree that my personal data will be processed in accordance with Revolut's Candidate Privacy NoticeGet what you need to succeedFinancial benefits that show we value your workFlexibility to work from home, the office, or abroadA Revolut Metal subscription loaded with perksExciting events year-round so you can get to know your team #

📌 Senior Information Security Engineer (España)
🏢 Revolut
📍 España