BillEase, a Philippine consumer lending and digital banking fintech, seeks a hands-on Senior Cybersecurity specialist to run pentests and red-team exercises across its Go/Python microservices on AWS/EKS, mobile apps, APIs, and infrastructure, while driving secure-by-design practices, AI-assisted vulnerability triage, and PCI DSS compliance.
Compensation
Not disclosed
Location
Not listed
Work setup
Remote
Seniority
Senior
Employment
Not specified
Experience
5+ years
Category
Security
Posted
Skills
agentic-ai
ai
android
api
api-security
aurora
authentication
automation
aws
bash
burp-suite
ci-cd
clickhouse
cloud
cloud-native
cloud-security
cryptography
cybersecurity
dast
dns
docker
eks
elk
event-driven-architecture
fintech
git
gitlab
graphql
grpc
iam
infrastructure-as-code
ios
jwt
kafka
kubernetes
llm
metasploit
microservices
nessus
nist
nmap
oauth
openapi
openid
owasp
pci-dss
penetration-testing
pki
postgresql
python
qualys
reverse-engineering
risk-assessment
root-cause-analysis
saml
sast
secrets-management
siem
snyk
soc-2
sonarqube
splunk
ssl
tcp-ip
terraform
threat-hunting
threat-modeling
tls
vulnerability-management
websockets
wireshark
xcode
Must have
5+ years in offensive security, application security, or security engineering with strong hands-on penetration-testing background
Track record of finding, exploiting, and responsibly reporting real vulnerabilities (CVEs, bug bounty, or documented engagements a plus)
Experience securing cloud-native, microservices environments in production — ideally fintech, banking, or regulated domain
Deep command of most security tooling categories (web app testing, network scanning, red team, mobile, RE, fuzzing, SAST/DAST/SCA, cloud/K8s security, SIEM)
API security testing across REST, GraphQL, gRPC (IDOR/BOLA, mass assignment, injection, business-logic abuse)
Demonstrable concrete AI-assisted security workflow (LLM agents for code analysis, triage, PoC generation, correlation with SAST)
Nice to have
Prior fintech, banking, or payments experience under PCI DSS
Bug bounty track record or published research / CVEs
Experience with Kafka, ClickHouse, or event-driven architectures from a security standpoint
Detection engineering and threat hunting experience
Infrastructure-as-code security (Terraform) and cloud security automation
Full description
About the role Billease operates consumer lending, merchant checkout, and digital banking products handling sensitive financial and personal data at scale. We run a cloud-native, microservices architecture on AWS/EKS, built primarily in Go and Python, backed by PostgreSQL/Aurora, Kafka, and ClickHouse, with native Android and iOS apps. We're looking for a hands-on Senior Cybersecurity Specialist who can break our systems before anyone else does — and then help us build them so they can't be broken. This is a deeply technical, offensive-minded role that also drives secure-by-design practices across engineering. You'll run penetration tests, hunt for exploitable flaws across our apps, APIs, protocols, and infrastructure, and bring a modern, AI-augmented approach to finding and triaging security issues at scale. This is an individual-contributor role with significant influence. You will not be managing a team — you will be the person engineers and leadership turn to for the hard security questions.
What you'll do Plan and execute penetration tests and red-team exercises against web apps, mobile apps, APIs, microservices, cloud infrastructure, and internal tooling. Perform mobile application security testing (Android & iOS) — static and dynamic analysis, runtime instrumentation, SSL pinning bypass, local storage and secrets review, and reverse engineering. Discover and prove exploitability of vulnerabilities across network and application protocols (TLS, HTTP/2, gRPC, OAuth2/OIDC, SAML, WebSocket, DNS, mTLS), producing working PoCs and clear remediation guidance. Review cryptographic implementations — key management, TLS configuration, token signing/encryption, data-at-rest and in-transit protections — and catch misuse of crypto primitives. Conduct secure code review (Go/Python) and threat modeling for new services and features; embed security gates into our GitLab CI/CD pipelines. Build and operate AI-assisted security workflows — automating recon, triage, code analysis, and vulnerability detection to scale coverage across ~85 engineers' output. Harden our AWS/EKS environment: IAM, network segmentation, Kubernetes security posture, container and supply-chain security, secrets management. Lead vulnerability management — prioritize, track, and verify remediation; reduce false positives and mean-time-to-fix. Support compliance and regulatory needs (PCI DSS, BSP requirements, Data Privacy Act / NPC) with evidence, controls testing, and risk assessments. Respond to incidents: investigate, contain, perform root-cause analysis, and drive preventative fixes. Mentor engineers and raise the organization's overall security maturity through guidance, tooling, and training.
Senior Cybersecurity at BillEase (Remote) — aijobsearch
Understanding LLM/AI system security itself (prompt injection, data exfiltration, OWASP Top 10 for LLM Applications)
Strong Python or Go skills — build own tooling and review/debug production code
Comfortable with Bash, Git/GitLab CI, Docker, and Kubernetes manifests
Core requirements
Experience
5+ years in offensive security, application security, or security engineering, with a strong hands-on penetration-testing background.
Demonstrated track record of finding, exploiting, and responsibly reporting real vulnerabilities (CVEs, bug bounty, or documented engagements a plus).
Experience securing cloud-native, microservices environments in production — ideally fintech, banking, or another regulated, high-trust domain.
Hands-on experience with security tooling You should be fluent with the categories below and the leading tools in each (we don't expect every single tool, but we expect deep command of most categories):
Mobile application security testing Proven experience testing Android and iOS apps end to end. Static and dynamic analysis, runtime hooking/instrumentation (Frida/Objection), SSL/TLS pinning bypass, tamper and root/jailbreak-detection analysis. Reverse engineering of APKs/IPAs; review of insecure local storage, hardcoded secrets, insecure IPC, and deep-link abuse. Familiarity with the OWASP MASVS / MASTG mobile security standards.
Security standards & frameworks OWASP — Top 10, ASVS, API Security Top 10, MASVS/MASTG, SAMM. PCI DSS (critical for our payment and lending flows). NIST — CSF, SP 800-53, SP 800-63 (digital identity). ISO/IEC 27001 / 27002, CIS Controls & Benchmarks, SOC 2. Awareness of BSP regulatory expectations and the Philippine Data Privacy Act (RA 10173 / NPC).
Cryptography Solid, practical understanding of modern cryptography and, just as importantly, how it gets misused: Symmetric: AES (GCM, CBC, modes & IV/nonce pitfalls), ChaCha20-Poly1305. Asymmetric: RSA, ECC (ECDSA, EdDSA/Ed25519, ECDH). Hashing & KDFs: SHA-2/3, HMAC, bcrypt, scrypt, Argon2, PBKDF2. Key exchange & PKI: Diffie-Hellman/ECDH, TLS 1.2/1.3, certificate lifecycle, mTLS. Tokens: JWT/JWS/JWE — signing, encryption, and common vulnerabilities (alg confusion, weak keys, replay). Key management and secrets with AWS KMS / HSM.
Protocol exploitation Ability to analyze and find exploitable flaws in network and application protocols: TCP/IP, TLS/SSL, HTTP/HTTPS, HTTP/2, gRPC, WebSocket, DNS, mTLS. Attacking authentication/authorization protocols — OAuth 2.0, OIDC, SAML (token theft, scope abuse, redirect and confusion attacks). API security testing across REST, GraphQL, and gRPC (IDOR/BOLA, mass assignment, injection, rate-limit and business-logic abuse).
AI-driven security (advanced specialty) We want someone who treats AI as a force multiplier for security work — not a buzzword. You should be able to demonstrate a concrete AI workflow for finding a security issue. For example: Example workflow we'd expect you to speak to (or demo live): Ingest a target service's source (Go/Python) and OpenAPI/proto definitions. Agentic analysis — drive an LLM agent (e.g., via scripted tool-calling) to map data flows, identify untrusted inputs, and flag candidate vulnerability classes (injection, auth bypass, SSRF, IDOR). Correlate LLM findings against SAST output (Semgrep/gosec/Bandit) to cut false positives and rank by exploitability. Generate and validate a PoC — have the agent draft an exploit request, run it against a staging target, and confirm the issue dynamically. Produce a remediation diff and a human-readable report
Additional AI-security expectations: Using LLMs for code review, log/anomaly triage, and detection-rule generation. Understanding LLM/AI system security itself — prompt injection, data exfiltration, model/supply-chain risks (OWASP Top 10 for LLM Applications), relevant to our own AI features. Programming Strong Python or \ Go skills — you build your own tooling, automate testing, and read/debug our production services. (Our stack is Go + Python, so you'll be reviewing real code, not just running scanners.) Comfortable with Bash, Git/GitLab CI, Docker, and Kubernetes manifests.
Nice to have Prior experience in fintech, banking, or payments under PCI DSS. Bug bounty track record or published research / CVEs. Experience with Kafka, ClickHouse, or event-driven architectures from a security standpoint. Detection engineering and threat hunting experience. Infrastructure-as-code security (Terraform) and cloud security automation.
What success looks like (first 6 months) Delivered at least one full-scope pentest across our mobile + API surface with prioritized, remediated findings. Security gates integrated into CI/CD with measurably fewer false positives. A working AI-assisted triage/analysis workflow in use by the team. A clear, risk-ranked view of our top vulnerabilities and a tracked path to closing them.