AppSec/DevSecOps engineer

About Fintech Farm

We are a UK fintech creating successful neobanks in emerging markets in partnerships with local traditional banks. The mission is to make banking services accessible, simple and fun to use worldwide and the goal is to launch neobanks in 50+ markets, serving 100m+ customers.
Our success builds upon a best-in-class product, customer experience, emotional engagement, viral marketing and deep credit-decisioning expertise across our product suite covering credit, payments, savings and investments. One of our founders also previously co-founded a highly successful Eastern European neobank with a multi-million customer base.
We launched our first market with Leobank in Azerbaijan in 2021, where we’ve already taken a leading market position. Our next market was Vietnam, where we launched Liobank in early 2023 and have also reached strong traction. We have several more markets on the roadmap in the next 12 months and are starting to build out teams there.

Why Fintech Farm is a Great Place to Be

Our Ambition

We are looking to become a leading consumer digital bank brand in each market we operate, making it easy for consumers to interact with their money. You could be a part of this exciting journey.

Our Culture

Customers

We always go above and beyond to provide an amazing customer experience. We serve our customers the way we would want our mom to be served. And who said that banking has to be boring? We make our apps not just easy but fun to use.

People

We are all business partners in our company. Each of us thinks big, acts as if we own the place and never takes “no” for an answer. We work with strong individuals whom we empower and trust rather than micromanage. Common sense rather than formal policies prevails in all that we do. We always stay curious and open-minded.
How we work:
We’re an AI-forward team. We expect engineers to lean on AI tools (Claude, MCP-driven / agent-centric workflows) to move faster, automating triage, accelerating code reviews, and scaling what one person can realistically cover. We measure outcomes, not hours.
What You’ll Do
— Own the integration and tuning of security scanners (SAST, DAST, SCA, secrets detection) in CI/CD pipelines — including defining pass/fail criteria and break-build policies
— Drive the vulnerability lifecycle end-to-end: triage, prioritization by severity and business impact, remediation coordination, and validation
— Conduct and support security testing of web, API, and mobile applications — including scoping and reviewing external pentest reports
— Participate in architecture and design reviews; identify threat vectors before they reach code
— Maintain security baselines and contribute technical evidence
— Build dashboards and metrics that make AppSec status visible and actionable for engineering and leadership
What We’re Looking For
— 2+ years in AppSec, product security, or a security-focused engineering role
— Hands-on experience with SAST/DAST/SCA tooling integrated into CI/CD — not just run manually
— Solid understanding of OWASP Top 10 (Web + API), ASVS, and common vulnerability classes
— Experience managing a vulnerability backlog: triage, prioritization, communication with developers, validation of fixes
— Can write clearly — findings, risk assessments, and status reports that land with both engineers and leadership
— Already uses AI tools day-to-day and instinctively looks for what to automate
Nice to Have
— Kubernetes or container security (image scanning, pod security, RBAC)
— Mobile security: OWASP MASVS, iOS/Android testing basics
— Threat modeling experience (any methodology)
— Scripting in Python or Bash for automation
— Familiarity with DefectDojo, Grafana, or Jira-based security tracking
— Exposure to PCI DSS or ISO 27001 in a technical role