Sr. Security Engineer

FastSpring provides payment solutions for AI, SaaS, gaming, software, and digital product companies. The Senior Security Engineer will strengthen the security of the core payments platform and establish security practices for AI-assisted software development. The role focuses on application security, AWS infrastructure security, secure development standards, risk and compliance initiatives, incident readiness, and stakeholder communication.

Responsibilities:

• Identify, prioritize, and remediate vulnerabilities across our Java-based platform and AWS infrastructure
• Drive infrastructure security improvements, including IAM policy refinement, instance metadata protections, and network egress controls
• Conduct security reviews of AI-assisted development pipelines, tool integrations, and agent-accessible services
• Develop and maintain secure development standards, patterns, and guardrails for engineering teams
• Partner with the fractional CISO on risk assessment, remediation planning, and compliance initiatives (including PCI DSS)
• Contribute to incident response readiness and security monitoring improvements
• Communicate security priorities and progress clearly to technical and executive stakeholders

Requirements:

• 7+ years of hands-on security engineering experience (application security, cloud security, or infrastructure security)
• Strong experience with AWS security services and primitives (IAM, VPC networking, secrets management)
• Experience working in and securing large production codebases; JVM ecosystem experience preferred
• Familiarity with modern AI-assisted development tools and an interest in their security implications
• Strong prioritization and communication skills; ability to advocate for security investments with stakeholders
• Experience in payments, fintech, or other regulated environments is a plus
• Relevant certifications (e.g., CISSP, OSCP, AWS Security Specialty) are a plus but not required
• Security certifications (e.g., AWS Security Specialty, CISSP, OSCP, GIAC)
• Experience securing payments, ecommerce, or subscription/billing platforms
• Experience with secure SDLC practices and integrating security tooling (SAST/DAST/SCA) into CI/CD
• Familiarity with global, multi-currency, or tax-calculation systems and their data-sensitivity considerations