QA engineer (auto) in application security in London

Hyperlayer is the intelligent banking platform built for the agentic economy: the financial control layer that sits above banks' existing cores, enabling next-generation Smart Accounts, without ripping anything out. From a single integration, we give financial institutions a secure rules and orchestration engine that lets them design, launch and scale hyper-personalised products in weeks while preserving stability, compliance and control.

Responsibilities:

• Test our APIs and apps against the OWASP API Security Top 10 and OWASP Top 10, with a focus on authentication, authorisation and data exposure.
• Ensure one bank can never see or change another bank's data, with automated tenant-isolation checks for every endpoint.
• Test agent-ready accounts: delegated permissions, spending limits, revocation and the audit trail for every agent action.
• Build automated security tests in Java and REST Assured, and turn every confirmed finding into a regression test.
• Add security checks to our CI/CD pipelines, such as DAST (e.g. OWASP ZAP), fuzzing (e.g. ffuf), SAST and dependency scanning, tuned so they don't create noise.
• Join design reviews and threat modelling for new features, and turn abuse cases into test cases.
• Prepare for external penetration tests, triage their findings with engineering, and verify fixes.
• Test HyperJar's mobile security, including secure storage, authentication and API usage, against OWASP MASVS.
• Report security risk clearly to inform release go/no-go decisions.
• Help other quality engineers add security checks to their own pods, using AI tools where they help.

Requirements:

• 5+ years in QA, quality engineering or application security, including at least 3 years of hands-on security testing of APIs and web applications.
• Strong practical knowledge of the OWASP API Security Top 10 and OWASP Top 10, with real findings you can talk about.
• Hands-on experience with security testing tools such as OWASP ZAP or Burp Suite.
• Solid understanding of authentication and authorisation: OAuth 2.0, OpenID Connect, JWT, session handling and role-based access control.
• Strong API testing skills, with experience automating tests in Java (or another JVM language) using REST Assured or similar.
• Experience adding security testing to CI/CD pipelines (e.g. Jenkins, Bitbucket Pipelines, GitHub Actions) and triaging scanner findings.
• Ability to explain risk and severity clearly to engineers and non-specialists.
• Comfortable in a fast-moving startup environment, balancing speed with the rigour needed when testing financial systems.
• Willing and able to be in our London office four days per week.
• Existing non-sponsored right to work in the UK.

Desirable:

• Experience in banking, payments or another regulated financial services environment, and awareness of expectations such as FCA rules, DORA or PCI DSS.
• Security certifications such as OSCP, OSWE, eWPT or CREST, or a background in penetration testing.
• Threat modelling experience (e.g. STRIDE).
• Mobile application security testing (OWASP MASVS, MobSF), ideally including Flutter apps.
• Experience testing multi-tenant SaaS platforms or services written in Go.
• Awareness of security risks in AI and agent-based systems, such as the OWASP Top 10 for LLM Applications.
• Cloud and container security experience (AWS, Docker, Kubernetes).

Conditions:

• This role is predominantly office-based in Paddington, London.
• No UK work visa sponsorship will be offered for these roles.
• A performance-based employee bonus scheme.
• 25 days annual leave plus bank holidays, a day off on your birthday, and an additional day per year of tenure to a maximum of 30.
• Critical illness and life insurance cover.
• AXA PPP Health Insurance, including gym offers.
• Cycle-to-work scheme.
• Referral bonus scheme.
• Workplace nursery scheme.