Senior QA Engineer – (Security)

About the role

• We're hiring a Senior Quality Engineer to lead security testing across Hyperlayer: our platform and

orchestration engine, the APIs banks integrate with, and HyperJar, our consumer app.

• Banks and financial institutions rely on us to keep their customers' money and data safe. Many banks share

one platform, and our accounts are agent-ready, so access control, tenant isolation and delegated

permissions have to be right every time.

• You'll make security testing a routine part of how we build and release: finding issues early, automating

checks in our pipelines, and turning every finding into a regression test.

• You'll bring strong API testing and automation skills in Java and REST Assured, so security tests sit alongside

our functional suites rather than in a separate silo.

• You'll report into the Head of Solution Architecture & QA and work closely with engineering, DevOps, our

Principal Quality Engineer and external penetration testers.

• This role is predominantly office-based in Paddington, London.

What you'll do

• Test our APIs and apps against the OWASP API Security Top 10 and OWASP Top 10, with a focus on

authentication, authorisation and data exposure.

• Make sure one bank can never see or change another bank's data, with automated tenant-isolation checks

for every endpoint.

• Test agent-ready accounts: delegated permissions, spending limits, revocation and the audit trail for every

agent action.

• Build automated security tests in Java and REST Assured, and turn every confirmed finding into a regression

test.

• Add security checks to our CI/CD pipelines, such as DAST (e.g. OWASP ZAP), fuzzing (e.g. ffuf), SAST and

dependency scanning, tuned so they don't create noise.

• Join design reviews and threat modelling for new features, and turn abuse cases into test cases.

• Prepare for external penetration tests, triage their findings with engineering, and verify fixes.

• Test HyperJar's mobile security, including secure storage, authentication and API usage, against OWASP

MASVS.

• Report security risk clearly to inform release go/no-go decisions.

• Help other quality engineers add security checks to their own pods, using AI tools where they help and