Senior Software Engineer - Product Security

Toast Toast · Enterprise · Dublin, Ireland · R & D : Security : Cybersecurity

Senior Product Security Engineer role at Toast, focusing on application security, anti-abuse, and threat modeling within a fintech domain. The role involves building security intelligence services, improving developer tooling, and assisting incident response, with an emphasis on leveraging AI tools for development and security operations. Requires experience in Java web services, Python scripting, and cloud architecture, with a strong preference for fintech security experience.

What you'd actually do

  1. Select, implement, design, and build services and tools to manage and deliver security intelligence across Toast platforms.
  2. Identify, triage, and provide remediation guidance for application vulnerabilities, with a specific focus on anti-abuse activities.
  3. Improve developer tooling and adoption to build a more robust SSDLC which integrates security and anti-abuse features.
  4. Practice a #OneTeam attitude to help other Toast teams make informed, security-conscious decisions when building new public-facing software.
  5. Assist incident response teams with application security expertise and tools, especially related to abuse and fraud.

Skills

Required

  • Minimum 5+ years of experience in application security and security engineering.
  • Experience building and maintaining scaled Java web services in production.
  • Experience developing script applications in Python for scheduling and backend data handling.
  • Experience leveraging LLM AI features for software development and/or security operations.
  • Strong understanding of cloud application architecture.
  • Successful history of being a subject matter expert to guide colleagues toward better security outcomes, especially related to abuse, fraud and legal concerns.
  • Previous security experience working with fintech applications and associated requirements.
  • Strong understanding of privacy, security, and cryptography patterns and when to apply them, especially when handling customer information (such as PKIs, access management, data tokenization, and anonymization).

Nice to have

  • Offensive security training and certifications (e.g. OSCP, OSWE, OSEP)
  • Edge Security solution like WAF, API Security
  • Adversary Emulation proficiency (red/purple teaming)
  • Cloud and container security technologies
  • SSDLC tooling (e.g., SAST/DAST/SCA)
  • Scaled data handling in RDBMS, streaming, and columnar stores
  • Metrics and charting software proficiency
  • Mobile apps/threats (iOS, Android), and their particular abuse vectors
  • Knowledge in security of operating systems, networking and protocols
  • Securing financial technologies and associated requirements

What the JD emphasized

  • Previous security experience working with fintech applications and associated requirements