Application Security Engineer

OnPlan, which recently joined the global fintech company Flywire, is a rapidly growing Software As a Service (SaaS) technology company that provides billing and payment software for the healthcare and higher education markets. Since 2009, Flywire has been creating solutions that break barriers, and teams that always look at the next disruptive way to move Flywire and its customers into the next phase of global payment solutions.

Global collaboration is at the heart of what we do at Flywire: Empowering opportunities globally and locally by solving complex payment problems. Our truly global team drives our creativity and success when it comes to making transactions faster, more secure, less expensive, and more transparent. We’re excited to watch our unique culture evolve with each new hire; it's our differences as individuals that make us stronger as a team.

We are looking to hire an eager and experienced Application Security Engineer. This individual will support our Security Team in providing security support for our development houses and ensure the privacy and security of confidential, business and personal information.

With diversity and inclusion at the core of our people agenda, we believe our FlyMates are our greatest asset, and as a member of the Engineering team, you will help accelerate Flywire across the globe!

Key Responsibilities

• Collaborate frequently with different engineering teams to identify and address security issues
• Have a part in every aspect of the development lifecycle
• Attend the daily stand ups to ensure that product features have security “built in”
• Drafting security requirements for any system, service or integration needed by Flywire
• Performing technical tasks on the change and integration reviews

Minimum Skills And Qualifications

• 3+ years of application security experience (source code auditing, penetration testing, product assessments, vulnerability research, reverse engineering, etc)
• Strong familiarity with the Ruby on rails, Java language and modern web development (e.g. JavaScript, AngularJS, Node.js, etc.)
• Understanding of OWASP security concepts and common application security risks, such as XSS, CSRF, SQL Injection, Cookie Manipulation, etc
• Experience with web application security, DevSecOps and/or secure SDLC
• A “breaker” mentality, but effective at crafting the mitigating controls
• Proven knowledge of applied cryptography
• Provide hands-on remediation guidance to development teams
• Influence the design and implementation of upcoming products and services with security and privacy by design mindset
• Working experience in authentication technologies, including OAuth, SAML, and SSO
• Proven interpersonal skills: Ability to explain complex technical issues to both technical and non-technical audiences