MoonPay: Information Security Engineer — Bengaluru, Karnataka

About MoonPay

MoonPay provides crypto payment infrastructure. Its services let consumers buy and sell cryptocurrency using cards and other standard payment methods, while businesses integrate on-ramp and trading functions for their users, and it also develops stablecoin payment tooling. The company operates from a United States base under financial licences in multiple markets, and its employer feed lists engineering, compliance and product roles.

The position and its setting

MoonPay lists Information Security Engineer in Bengaluru, Karnataka, under reference 202dec29-039f-4211-8d8e-4ce8e36511ab. The details below separate the work described by the employer from essential conditions, preferred experience and practical preparation advice.

• Department: Technology & Security Services
• Employment type: Full Time
• team: Information / Cyber Security

Responsibilities and work described

• An Information Security Engineer, SaaS & Integration Security, to join our Information Security team, focused on securing our internal SaaS ecosystem, third-party integrations, APIs, and automation workflows
• You are a hands-on individual contributor who is comfortable working across technical tooling, process development, and cross-functional collaboration
• SaaS and integration security
• Set and maintain security standards for SaaS apps, integrations, APIs, plugins, and automation platforms
• Assess new applications and integrations before approval, reviewing architecture, data flows, and trust boundaries
• Evaluate OAuth scopes, tokens, service accounts, webhooks, extensions, and marketplace apps for excessive permissions, cross-tenant exposure, and unauthorized access
• Define approved security patterns for APIs, non-human identities, and automation workflows
• Assess AI assistants and third-party AI integrations accessing company systems
• Detects and reduces shadow IT and unsanctioned SaaS-to-SaaS connections
• Threat modeling and secure design
• Facilitate risk-based threat modeling for SaaS apps, integrations, APIs, scripts, and internal tools
• Identify trust boundaries, abuse cases, and sensitive-data exposure; ensure risks have owners, mitigations, and timelines
• Delivery: secure design alternatives when proposed solutions create unacceptable risk
• Maintenance: reusable threat models and review checklists for common integration patterns
• Script and automation security
• Review: Python, JavaScript, shell, and low-code/no-code automations for secrets handling, injection risks, unsafe data processing, and excessive permissions

Essential requirements and candidate background

• 👉 Describe the ideal candidate’s qualifications, skills, experience, and behaviours that show culture alignment
• You’re an Information Security Engineer who can both build and operate at scale
• You have expertise in DLP and are equally comfortable with leading incident response
• Be working primarily on the following stack: Apple systems, Google Workspace, Slack, Mimecast Code42, Okta, Crowdstrike, Cloudflare WARP, Tenable Nessus and Jamf Pro
• Must-have experience and skills
• Experiences
• 3+ years in SaaS security, application security, cloud security, or a related defensive security role
• Experience conducting technical security reviews and risk-based threat modeling
• Track record of assessing third-party integrations, APIs, and vendor risk before adoption
• Experience validating security findings and driving remediation with engineering/business teams
• Cybersecurity Principles
• Grasp of least privilege, defense in depth, and trust boundary analysis
• Understanding: identity and access concepts: OAuth, SAML, OIDC, SSO, MFA
• Familiarity: common integration risks: excessive permissions, cross-tenant exposure, insecure data flows, injection, credential exposure, supply-chain compromise
• Knowledge: frameworks such as OWASP, MITRE ATT&CK, NIST, or CIS Controls
• Technical Proficiency
• Read and review scripts in Python, JavaScript, or shell for security weaknesses
• Understanding: secrets management, short-lived credentials, and secure API design
• Hands-on experience securing identity and productivity platforms such as Okta, Google Workspace, and Google Cloud Platform
• Experience assessing security and access controls in collaboration/SaaS tools such as Linear, Slack, Notion, Intercom, and Atlassian (Jira/Confluence)

Education and qualification routes

• Degree / qualification: Bachelor's degree in Computer Science, Information Security, or a related field

Preferred experience and additional strengths

• Education
• Equivalent work experience will be considered
• Security Frameworks
• Experience: frameworks such as ISO 27001, SOC 2, and PCI-DSS
• Defining and implementing key security controls
• Incident Response
• Practical incident response experience including triage, investigation, containment, and communications
• Vulnerability Management
• Identifying, prioritizing, and automating remediation of security vulnerabilities
• Vendor / Third-Party Security
• Experience conducting vendor and third-party security assessments, including evaluating risk posture, reviewing security questionnaires, and ensuring third parties meet organizational security standards
• 👉 Optional extras that would help a candidate stand out (keep this short)

Location, schedule and contract conditions

• India, Bengaluru
• Relocation available: No
• Work pattern:
• This role will be in the office
• On-site 5 days per week
• Working hours: 12:00 to 9:00 PM IST
• Advertised location: Bengaluru, Karnataka

Benefits mentioned by the employer

• 💰 Competitive salary package
• 🤝 Equity package: financial freedom starts with our employees, so all employees have ownership at MoonPay
• 📈 Pay-for-performance equity bonus: those who drive outsized outcomes receive outsized rewards
• 🚀 Moonshot award: we honor impact. 20 employees a year, each earning a $250,000 equity grant
• 📊Pension: employer contributions from day one
• 🎁Employee referral program: refer great people, earn 10K in USDC
• 🏝 Flexible Time Off: choose when to work and when to switch off
• 🔋Recharge Period: end-of-year company-wide time off to rest and reset
• 🎂 Birthday leave: take the day off to celebrate you
• 🍼 Enhanced parental leave: more time with family, no second thought
• 🌍 Hybrid working schedule: work fully remotely or from your nearest Moonbase
• 🚆 Commuter benefits: public transport to and from the office

Conditions requiring the complete notice

Some passages contain complex or combined conditions that have not been reduced to short eligibility statements here. Read the complete linked notice for those passages, including any alternatives, exceptions or restrictions. The concise facts above should not be treated as the full wording of every condition.

Pay and application dates

A verified salary figure is not established in this article. An online estimate for another Information Security Engineer vacancy is not an offer for reference 202dec29-039f-4211-8d8e-4ce8e36511ab; use the employer’s own pay disclosure and recruitment communication.

A closing date is not confirmed in this article. Check the current employer page before submitting: an undated posting can change or be withdrawn.

How to apply to MoonPay

Applications follow the official employer page linked below.

Open the official MoonPay posting below and match the title and reference 202dec29-039f-4211-8d8e-4ce8e36511ab.

Compare your qualifications and experience with the essential conditions for the Bengaluru, Karnataka position, then read the preferred criteria separately.

Prepare an accurate CV and the supporting items requested in that employer’s application. Provide only information and documents you are authorised to share.

Use the employer’s application option, complete the required fields and review the submission. Retain the acknowledgement when one is provided. Job Alerts World does not receive the application.

Practical preparation: Python

Python work is easier to assess through a concrete example than a list of libraries. Explain the problem, the input data, the parts you implemented and how you checked the output. Include a repository or a short technical note when you can share it.

Relevant skills

• Python
• JavaScript
• GCP
• APIs
• AI/ML
• ISO
• Google Cloud
• AI
• cybersecurity
• risk management
• compliance
• communication