Information Security Engineer (AppSec)

Revolut is a financial technology company serving 80+ million customers globally with products including spending, saving, investing, exchanging, and travelling. The company has over 13,000 employees across multiple locations worldwide, supporting rapid growth and innovation in financial services.

• 3+ years of hands-on experience in application security, penetration testing, or related security engineering
• Solid understanding of common web, mobile, and API vulnerabilities (e.g., OWASP Top 10, CWE) with practical remediation approaches
• Experience in code reviews, design reviews, and threat modelling for modern application architectures
• Familiarity with DevSecOps practices and integrating security tooling into CI/CD pipelines
• Working knowledge of authentication, authorisation, session management, and cryptographic best practices
• Proficiency with security tools such as Burp Suite, MobSF, Frida, or custom scripts for dynamic and static analysis
• Basic understanding of cloud security principles with experience working in GCP or AWS environments
• Strong communication skills for collaboration with Engineering, Product, and DevOps teams
• Proactive mindset and passion for secure engineering practices
• Ability to work independently and as a trusted team player in a fast-paced environment

Nice to have:

• Experience participating in Red Team exercises
• Managing bug bounty programmes
• Contributing to open-source security tools or research

• Perform security assessments on product designs, mobile apps (iOS, Android), web applications, and APIs
• Participate in Red Team missions and threat-led testing to simulate attacker behaviours
• Lead and conduct penetration testing across applications, infrastructure, and APIs using manual and automated tools
• Manage and evolve the private bug bounty programme, validate submissions, collaborate with researchers, and resolve findings
• Contribute to cloud security posture, identifying misconfigurations and working with DevOps on GCP and AWS best practices
• Partner with engineering teams to embed security into the software development lifecycle, providing guidance on secure architecture and threat modelling
• Develop and enforce internal AppSec standards, policies, and practices aligned with OWASP, NIST, and industry benchmarks
• Research and evaluate emerging threats, tools, and technologies
• Contribute to internal security training, knowledge sharing, and mentoring junior team members

• Candidates must apply only through official Revolut channels and be wary of job scams
• Communications will be via official Revolut emails with @revolut.com domain
• No payment or personal financial information will be requested during the hiring process
• Application information must be truthful; falsification may lead to rejection or termination
• Personal data will be processed according to Revolut's Candidate Privacy Notice