About the Position

Information Security Engineer

Location: Bengaluru, Karnataka

Company: MoonPay

Employment Type: Full Time

Work Pattern: On-site, 5 days per week, 12:00 to 9:00 PM IST

About MoonPay

MoonPay is a high-standards, high-velocity, high-accountability company building the operating system for value movement. Licensed in the U.S. and regulated across the UK, EU, Canada, and Australia, we move value: crypto, stablecoins, tokenized assets, and more. Our four offerings are: fund, tokenize, trade, and spend. With 30M+ customers and 500+ ecosystem partners, we are recognized as Forbes' America's Best Startup Employers 2026, 2nd in Crypto Services on Fortune's inaugural Crypto 100, and The Sunday Times Best Places to Work for two years running.

About the Opportunity

The Security Operations (SecOps) team at MoonPay is dedicated to ensuring the security and integrity of our systems and data in an increasingly complex digital landscape. Our multicultural team brings together a wealth of expertise and perspectives to tackle security challenges effectively. We focus on identifying and mitigating vulnerabilities and threats while maintaining strict compliance with security policies and relevant regulations.

Our mission is to create a secure environment for our employees, clients, and partners by leveraging advanced security measures and proactive threat detection techniques. We foster a culture of security awareness, sharing best practices, and ensuring that everyone at MoonPay understands their role in maintaining a secure environment.

Responsibilities

SaaS and Integration Security
- Set and maintain security standards for SaaS apps, integrations, APIs, plugins, and automation platforms.
- Assess new applications and integrations before approval, reviewing architecture, data flows, and trust boundaries.
- Evaluate OAuth scopes, tokens, service accounts, webhooks, extensions, and marketplace apps for excessive permissions, cross-tenant exposure, and unauthorized access.
- Define approved security patterns for APIs, non-human identities, and automation workflows.
- Assess AI assistants and third-party AI integrations accessing company systems.
- Detect and reduce shadow IT and unsanctioned SaaS-to-SaaS connections.
Threat Modeling and Secure Design
- Facilitate risk-based threat modeling for SaaS apps, integrations, APIs, scripts, and internal tools.
- Identify trust boundaries, abuse cases, and sensitive-data exposure; ensure risks have owners, mitigations, and timelines.
- Provide secure design alternatives when proposed solutions create unacceptable risk.
- Maintain reusable threat models and review checklists for common integration patterns.
Script and Automation Security
- Review Python, JavaScript, shell, and low-code/no-code automations for secrets handling, injection risks, unsafe data processing, and excessive permissions.
- Promote centralized secrets management, short-lived credentials, and least privilege.
- Build automated checks for exposed secrets and insecure configurations.
- Provide clear remediation guidance to engineers and automation owners.
Vendor / Third-Party Security
- Conduct vendor and third-party security assessments, evaluating risk posture and reviewing security questionnaires.
- Review vendor documentation (SOC 2 reports, pen test summaries) as part of the SaaS approval process.
- Assess third-party access to company systems and data, including sub-processor risk.
- Reassess vendor risk over time as scope or posture changes.
- Partner with Legal and Privacy on contractual security requirements.
L2 Incident Response (Operational Role)
- Monitor SaaS environments for suspicious activity, unauthorized integrations, and data-leakage risks.
- Actively participate in Security Operations activities as an L2 Incident Responder.
- Lead incidents through all stages: identification, containment, eradication, recovery, and lessons learned.
- Serve as the primary point of contact for the SOC regarding SIEM investigations, platform behavior, detection logic, and operational troubleshooting.
- Support continuous improvement by translating incident learnings into better detections, dashboards, and playbooks.

Requirements

Must-Have Experience and Skills

Experience
- 3+ years in SaaS security, application security, cloud security, or a related defensive security role.
- Experience conducting technical security reviews and risk-based threat modeling.
- Track record of assessing third-party integrations, APIs, and vendor risk before adoption.
- Experience validating security findings and driving remediation with engineering/business teams.
Cybersecurity Principles
- Strong grasp of least privilege, defense in depth, and trust boundary analysis.
- Solid understanding of identity and access concepts: OAuth, SAML, OIDC, SSO, MFA.
- Familiarity with common integration risks: excessive permissions, cross-tenant exposure, insecure data flows, injection, credential exposure, supply-chain compromise.
- Working knowledge of frameworks such as OWASP, MITRE ATT&CK, NIST, or CIS Controls.
Technical Proficiency
- Ability to read and review scripts in Python, JavaScript, or shell for security weaknesses.
- Understanding of secrets management, short-lived credentials, and secure API design.
- Hands-on experience securing identity and productivity platforms such as Okta, Google Workspace, and Google Cloud Platform.
- Experience assessing security and access controls in collaboration/SaaS tools such as Linear, Slack, Notion, Intercom, and Atlassian (Jira/Confluence).
- Comfort building or using automated checks/tooling to detect exposed secrets, misconfigurations, or permission risks across a SaaS-first stack.
Analytical Skills
- Excellent analytical and problem-solving abilities.
Crisis Management
- Ability to work effectively under pressure.
- Capable of handling multiple incidents simultaneously.
Communication
- Strong communication and interpersonal skills to collaborate with various teams.

Nice-to-Have Experience

Education
- Bachelor's degree in Computer Science, Information Security, or a related field. Equivalent work experience will be considered.
Security Frameworks
- Experience with frameworks such as ISO 27001, SOC 2, and PCI-DSS.
- Responsible for defining and implementing key security controls.
Incident Response
- Practical incident response experience including triage, investigation, containment, and communications.
Vulnerability Management
- Identifying, prioritizing, and automating remediation of security vulnerabilities.
Vendor / Third-Party Security
- Experience conducting vendor and third-party security assessments, including evaluating risk posture, reviewing security questionnaires, and ensuring third parties meet organizational security standards.

Bonus Points

Certifications
- CompTIA Security+, CySA+, CCSP, or equivalent certifications are a plus.
- OSCP, GWAPT are a plus.
Technical Proficiency
- Proven experience with tools such as Google Workspace / Cloud Platform, Okta, Slack, Intercom, Notion, Linear, Crowdstrike.

We Offer

💰 Competitive salary package
🤝 Equity package: financial freedom starts with our employees, so all employees have ownership at MoonPay
📈 Pay-for-performance equity bonus: those who drive outsized outcomes receive outsized rewards
🚀 Moonshot award: we honor exceptional impact. 20 employees a year, each earning a $250,000 equity grant
📊 Pension: employer contributions from day one
🎁 Employee referral program: refer great people, earn 10K in USDC
🏝 Flexible Time Off: choose when to work and when to switch off
🔋 Recharge Period: end-of-year company-wide time off to rest and reset
🎂 Birthday leave: take the day off to celebrate you
🍼 Enhanced parental leave: more time with family, no second thought
🌍 Hybrid working schedule: work fully remotely or from your nearest Moonbase
🚆 Commuter benefits: public transport to and from the office
🩺 Private healthcare benefits: to protect you and your loved ones
🧘 Wellhub wellness membership: access to gyms, studios, classes, and wellness apps in one membership
🤖 Enterprise access to the latest AI tools: Claude, ChatGPT, Gemini and whatever's next
🍱 Lunch credit: meals covered on the days you're in the office
🪑 Home office setup allowance: build the home office of your dreams
👛 Remote working allowance: those working fully remotely get a little extra for utilities
🌕 Monthly product budget and zero-fee crypto transactions
📚 $1,000 Annual training budget: we support your learning journey
🎯 High Potential Program: structured development, mentorship, and stretch opportunities
✈️ Regular remote company offsites: high-impact in-person sessions and hackathons
🚲 (Ireland) Cycle to Work scheme: tax-efficient bike, gear, and safety kit
🔌 (UK) EV Salary Sacrifice: lease an electric vehicle through pre-tax salary

About the Company

MoonPay is for builders with something to prove. This isn't a "work on cool crypto stuff" company. It's a high-standards, high-velocity, high-accountability company building the operating system for value movement. If the internet moves information, we move value: crypto, stablecoins, tokenized assets, and whatever comes next. Four offerings make that real: fund, tokenize, trade, and spend. 30M+ customers and 500+ ecosystem partners run on us. Licensed in the U.S. Regulated across the UK, EU, Canada, and Australia.

AI is the default operating mode here. It's woven into every role, and we expect you to use it daily. It handles the manual work so you can deliver on what actually matters.

You'll thrive here if outcomes excite you more than process, if impact motivates you more than titles, and if you want hard problems, real ownership, and teammates who love winning, building, and doing it together.

The bar is high. The pace is real. We're building for what's next, for humans and agents.

Information Security Engineer

Job description