Information Security Engineer

📋 Job Overview

This role is for builders with something to prove. MoonPay is a high-standards, high-velocity, high-accountability company building the operating system for value movement. We move value: crypto, stablecoins, tokenized assets, and whatever comes next. The Security Operations (SecOps) team is dedicated to ensuring the security and integrity of our systems and data in an increasingly complex digital landscape.

🏢 About MoonPay

MoonPay is for builders with something to prove. This isn't a "work on cool crypto stuff" company. It's a high-standards, high-velocity, high-accountability company building the operating system for value movement. If the internet moves information, we move value: crypto, stablecoins, tokenized assets, and whatever comes next. Four offerings make that real: fund, tokenize, trade, and spend. 30M+ customers and 500+ ecosystem partners run on us. Licensed in the U.S. Regulated across the UK, EU, Canada, and Australia.

AI is the default operating mode here. It's woven into every role, and we expect you to use it daily. It handles the manual work so you can deliver on what actually matters.

You'll thrive here if outcomes excite you more than process, if impact motivates you more than titles, and if you want hard problems, real ownership, and teammates who love winning, building, and doing it together.

The bar is high. The pace is real. We're building for what's next, for humans and agents.

🎯 The Role

We are looking for an Information Security Engineer, SaaS & Integration Security, to join our Information Security team, focused on securing our internal SaaS ecosystem, third-party integrations, APIs, and automation workflows. In this role, you will own the security review process for new SaaS applications and integrations end to end, build out threat modeling and secure design practices across the integration lifecycle, and contribute to incident response for SaaS and identity-related events. You are a hands-on individual contributor who is comfortable working across technical tooling, process development, and cross-functional collaboration.

✅ Key Responsibilities

• SaaS and integration security
• Set and maintain security standards for SaaS apps, integrations, APIs, plugins, and automation platforms.
• Assess new applications and integrations before approval, reviewing architecture, data flows, and trust boundaries.
• Evaluate OAuth scopes, tokens, service accounts, webhooks, extensions, and marketplace apps for excessive permissions, cross-tenant exposure, and unauthorized access.
• Define approved security patterns for APIs, non-human identities, and automation workflows.
• Assess AI assistants and third-party AI integrations accessing company systems.
• Detects and reduces shadow IT and unsanctioned SaaS-to-SaaS connections.

• Threat modeling and secure design
• Facilitate risk-based threat modeling for SaaS apps, integrations, APIs, scripts, and internal tools.
• Identify trust boundaries, abuse cases, and sensitive-data exposure; ensure risks have owners, mitigations, and timelines.
• Provide secure design alternatives when proposed solutions create unacceptable risk.
• Maintain reusable threat models and review checklists for common integration patterns.

• Script and automation security
• Review Python, JavaScript, shell, and low-code/no-code automations for secrets handling, injection risks, and secure coding practices.

🛂 Visa & Eligibility

Relocation available: No

Work pattern: This role will be in the office. On-site 5 days per week. Working hours: 12:00 to 9:00 PM IST