BillEase

About the role

Billease operates consumer lending, merchant checkout, and digital banking products handling sensitive financial and personal data at scale. We run a cloud-native, microservices architecture on AWS/EKS, built primarily in Go and Python, backed by PostgreSQL/Aurora, Kafka, and ClickHouse, with native Android and iOS apps.

We're looking for a hands-on Senior Cybersecurity Specialist who can break our systems before anyone else does — and then help us build them so they can't be broken. This is a deeply technical, offensive-minded role that also drives secure-by-design practices across engineering. You'll run penetration tests, hunt for exploitable flaws across our apps, APIs, protocols, and infrastructure, and bring a modern, AI-augmented approach to finding and triaging security issues at scale.

This is an individual-contributor role with significant influence. You will not be managing a team — you will be the person engineers and leadership turn to for the hard security questions.

What you'll do

• Plan and execute penetration tests and red-team exercises against web apps, mobile apps, APIs, microservices, cloud infrastructure, and internal tooling.
• Perform mobile application security testing (Android & iOS) — static and dynamic analysis, runtime instrumentation, SSL pinning bypass, local storage and secrets review, and reverse engineering.
• Discover and prove exploitability of vulnerabilities across network and application protocols (TLS, HTTP/2, gRPC, OAuth2/OIDC, SAML, WebSocket, DNS, mTLS), producing working PoCs and clear remediation guidance.
• Review cryptographic implementations — key management, TLS configuration, token signing/encryption, data-at-rest and in-transit protections — and catch misuse of crypto primitives.
• Conduct secure code review (Go/Python) and threat modeling for new services and features; embed security gates into our GitLab CI/CD pipelines.
• Build and operate AI-assisted security workflows — automating recon, triage, code analysis, and vulnerability detection to scale coverage across ~85 engineers' output.
• Harden our AWS/EKS environment: IAM, network segmentation, Kubernetes security posture, container and supply-chain security, secrets management.
• Lead vulnerability management — prioritize, track, and verify remediation; reduce false positives and mean-time-to-fix.
• Support compliance and regulatory needs (PCI DSS, BSP requirements, Data Privacy Act / NPC) with evidence, controls testing, and risk assessments.
• Respond to incidents: investigate, contain, perform root-cause analysis, and drive preventative fixes.
• Mentor engineers and raise the organization's overall security maturity through guidance, tooling, and training.

Core requirements

Experience

• 5+ years in offensive security, application security, or security engineering, with a strong hands-on penetration-testing background.
• Demonstrated track record of finding, exploiting, and responsibly reporting real vulnerabilities (CVEs, bug bounty, or documented engagements a plus).
• Experience securing cloud-native, microservices environments in production — ideally fintech, banking, or another regulated, high-trust domain.
•  

Hands-on experience with security tooling

You should be fluent with the categories below and the leading tools in each (we don't expect every single tool, but we expect deep command of most categories):

Web app testing

Burp Suite (Pro), OWASP ZAP, Nikto, sqlmap, Acunetix

Network & vuln scanning

Nmap, Nessus, OpenVAS, Qualys, Nexpose, Masscan

Exploitation / red team

Metasploit, Cobalt Strike, Sliver, Impacket, BloodHound

Mobile security

MobSF, Frida, Objection, Drozer, apktool, jadx, Hopper, Corellium, Xcode/Android Studio

Reverse engineering

Ghidra, IDA Pro, radare2 / Cutter, Binary Ninja

Fuzzing

AFL++, libFuzzer, boofuzz, Jazzer

SAST / DAST / SCA

Semgrep, SonarQube, Checkmarx, Fortify, Snyk, Bandit (Python), gosec (Go)

Cloud & Kubernetes security

Prowler, ScoutSuite, kube-bench, kube-hunter, Falco, Trivy, Checkov, tfsec/Terrascan

Container & supply chain

Trivy, Grype, Clair, Anchore, Cosign / Sigstore

Secrets scanning

Gitleaks, TruffleHog

Traffic & protocol analysis

Wireshark, tcpdump, mitmproxy

Credential attacks

Hashcat, John the Ripper, Hydra

SIEM / detection

Splunk, Elastic Security (ELK), Wazuh

Mobile application security testing

• Proven experience testing Android and iOS apps end to end.
• Static and dynamic analysis, runtime hooking/instrumentation (Frida/Objection), SSL/TLS pinning bypass, tamper and root/jailbreak-detection analysis.
• Reverse engineering of APKs/IPAs; review of insecure local storage, hardcoded secrets, insecure IPC, and deep-link abuse.

• Familiarity with the OWASP MASVS / MASTG mobile security standards.

   

Security standards & frameworks

• OWASP — Top 10, ASVS, API Security Top 10, MASVS/MASTG, SAMM.
• PCI DSS (critical for our payment and lending flows).
• NIST — CSF, SP 800-53, SP 800-63 (digital identity).
• ISO/IEC 27001 / 27002, CIS Controls & Benchmarks, SOC 2.

• Awareness of BSP regulatory expectations and the Philippine Data Privacy Act (RA 10173 / NPC).

   

Cryptography

Solid, practical understanding of modern cryptography and, just as importantly, how it gets misused:

• Symmetric: AES (GCM, CBC, modes & IV/nonce pitfalls), ChaCha20-Poly1305.
• Asymmetric: RSA, ECC (ECDSA, EdDSA/Ed25519, ECDH).
• Hashing & KDFs: SHA-2/3, HMAC, bcrypt, scrypt, Argon2, PBKDF2.
• Key exchange & PKI: Diffie-Hellman/ECDH, TLS 1.2/1.3, certificate lifecycle, mTLS.
• Tokens: JWT/JWS/JWE — signing, encryption, and common vulnerabilities (alg confusion, weak keys, replay).

• Key management and secrets with AWS KMS / HSM.

   

Protocol exploitation

• Ability to analyze and find exploitable flaws in network and application protocols: TCP/IP, TLS/SSL, HTTP/HTTPS, HTTP/2, gRPC, WebSocket, DNS, mTLS.
• Attacking authentication/authorization protocols — OAuth 2.0, OIDC, SAML (token theft, scope abuse, redirect and confusion attacks).

• API security testing across REST, GraphQL, and gRPC (IDOR/BOLA, mass assignment, injection, rate-limit and business-logic abuse).

   

AI-driven security (advanced specialty)

We want someone who treats AI as a force multiplier for security work — not a buzzword. You should be able to demonstrate a concrete AI workflow for finding a security issue. For example:

Example workflow we'd expect you to speak to (or demo live):

1. Ingest a target service's source (Go/Python) and OpenAPI/proto definitions.
2. Agentic analysis — drive an LLM agent (e.g., via scripted tool-calling) to map data flows, identify untrusted inputs, and flag candidate vulnerability classes (injection, auth bypass, SSRF, IDOR).
3. Correlate LLM findings against SAST output (Semgrep/gosec/Bandit) to cut false positives and rank by exploitability.
4. Generate and validate a PoC — have the agent draft an exploit request, run it against a staging target, and confirm the issue dynamically.

5. Produce a remediation diff and a human-readable report

    

Additional AI-security expectations:

• Using LLMs for code review, log/anomaly triage, and detection-rule generation.
• Understanding LLM/AI system security itself — prompt injection, data exfiltration, model/supply-chain risks (OWASP Top 10 for LLM Applications), relevant to our own AI features.

Programming

• Strong Python or \ Go skills — you build your own tooling, automate testing, and read/debug our production services. (Our stack is Go + Python, so you'll be reviewing real code, not just running scanners.)
• Comfortable with Bash, Git/GitLab CI, Docker, and Kubernetes manifests.

Nice to have

• Prior experience in fintech, banking, or payments under PCI DSS.
• Bug bounty track record or published research / CVEs.
• Experience with Kafka, ClickHouse, or event-driven architectures from a security standpoint.
• Detection engineering and threat hunting experience.
• Infrastructure-as-code security (Terraform) and cloud security automation.

What success looks like (first 6 months)

• Delivered at least one full-scope pentest across our mobile + API surface with prioritized, remediated findings.
• Security gates integrated into CI/CD with measurably fewer false positives.
• A working AI-assisted triage/analysis workflow in use by the team.
• A clear, risk-ranked view of our top vulnerabilities and a tracked path to closing them.

In this key role, you’ll work closely with our development group leader and collaborate with the broader engineering team to build and maintain high-quality iOS applications.

Key Responsibilities

• Develop and maintain iOS applications using Swift and SwiftUI
• Manage the full technical lifecycle of iOS apps — from design and development to testing, deployment, and ongoing support
• Collaborate with cross-functional team members to deliver new features and improve user experience
• Troubleshoot issues, optimize performance, and ensure application reliability
• Contribute to architectural decisions and code reviews

Requirements

• 7+ years of professional experience in native iOS development
• Strong expertise in Swift and SwiftUI
• Solid understanding of Apple’s design principles and iOS Human Interface Guidelines
• Familiarity with Git, CocoaPods, and popular third-party frameworks (e.g., Firebase, MoEngage)

Join the senior team behind the Billease Android app — a Kotlin & Jetpack Compose fintech product that millions rely on for payments, credit, and secure account access. You'll own features end-to-end, raise the engineering bar alongside other senior developers, and help keep a fintech-grade codebase fast, secure, and a pleasure to work in.

 

What you'll do

• Own features end-to-end — from the networking and data layers through to pixel-accurate Jetpack Compose UI, verified in production.
• Help uphold and evolve the architecture: a clean, layered flow (data → domain → presentation), clear module boundaries, and reactive single-source-of-truth state.
• Raise the bar through rigorous code review, shared standards, and mentoring — contributing to a strong senior team, not working in isolation.
• Keep the app crash-resilient, performant, and secure — careful recomposition, disciplined null-safety, and sensitive data encrypted at rest.
• Investigate and drive production issues to root cause, then ship the fix and the regression guard.
• Help shape conventions, module design, and technical direction together with the team as the product scales.
  
  What we're looking for
  These are the bar for the role — a strong senior should meet essentially all of them, with real depth (not just exposure) in the core engineering areas.
   
  • 7+ years of professional Android development, including meaningful time in a senior or lead role owning architecture and technical decisions — not just closing tickets.
  • Expert-level Kotlin — structured concurrency with coroutines, Flow / StateFlow, strict null-safety, and a feel for clean, stable public API design.
  • Deep production Jetpack Compose: state hoisting, recomposition and performance tuning, custom layouts, and type-safe Compose Navigation at scale.
  • Command of MVVM / clean architecture and DI (Hilt/Dagger) — able to shape and uphold layering and patterns across a large codebase, not just follow them.
  • Fluent in a multi-module Gradle codebase and a disciplined Git / MR-based workflow with thorough reviews.
  • Solid REST networking (Ktor/Retrofit) and JSON serialization, local persistence (Room), and a proven security-first instinct for auth, sessions, and data at rest.
  • Fluent working from Figma — reading designs, specs, and a design-token system, and turning them into faithful, reusable Compose components in close partnership with designers.
  • Effective, judgment-driven use of AI coding tools (e.g. Claude Code, Copilot) — using them to move faster while critically reviewing and validating everything they produce to a senior's standard.
    
    The way you show up
     
    • Actively drive technical and feature discussions — asking sharp questions, weighing trade-offs, and helping the team land on the right approach.
    • Lead the charge when it counts: investigate and triage production issues, trace root causes, and drive them to resolution.
    • Take ownership end-to-end — you plan before you build, flag risks early, and see work through to verified-in-production.
    • Collaborate well in a cross-functional, fast-moving team and are comfortable with ambiguity.
      
      Nice to have
       
      • Fintech or payments experience at scale — with a security-first mindset.
      • Hands-on with data-at-rest encryption (Keystore / Tink), auth/session handling, biometrics, or KYC / liveness flows.
      • Feature-flagged delivery, analytics instrumentation, and crash monitoring.
      • Static analysis and quality gates (detekt / ktlint) and E2E UI testing.
      • Experience migrating legacy XML/Fragment screens to Compose, and contributing to a shared design system.
        
        What you'll work with
        Language & UI
        - Kotlin
        - Jetpack Compose
        - Compose Navigation
        - Coroutines + Flow
        - Figma / Design tokens
        
        Architecture & data
        - MVVM / Clean
        - Hilt
        - Ktor
        - kotlinx.serialization
        - Room
        - Multi-module Gradle
        
        Quality & security
        - JUnit + MockK
        - detekt
        - Keystore / encryption
        - Feature flags
        - AI-assisted dev

WHAT YOU'LL DO:
Discovery & requirements
- Engage business stakeholders directly to elicit, clarify, and document business requirements.
- Turn ambiguous problems into clear, testable requirements — using AI to accelerate research, drafting, and gap analysis.

Solution design & specification
- Produce technical solutions and specifications: data models, API contracts (OpenAPI), service boundaries, sequence and architecture diagrams.
- Make sound architecture decisions aligned with our microservices, event-driven, and security-first principles, and document the trade-offs.

Build (backend / frontend / mobile)
- Implement backend services in Python and/or Golang on PostgreSQL, with appropriate messaging (Kafka) and caching.
- Build web frontends (Vue/Nuxt or React) and, where needed, mobile features (Android/Kotlin, iOS/Swift).
- Write reusable, testable, efficient code, using AI coding agents to move fast while keeping the codebase clean and reviewable.

Test & quality
- Design and execute meaningful test coverage — unit, integration, API, and end-to-end — leveraging AI-assisted test generation and review.
- Own quality end to end: you are the developer *and* the tester, and "done" means verified.

Ship & operate
- Deliver through our CI/CD pipelines and infrastructure as code.
- Build observability in at design time (metrics, logs, tracing) and support what you ship.
 

• 
  HOW WE WORK
  - Stack: AWS, Kubernetes, Python & Golang, PostgreSQL, Kafka, Vue/Nuxt & React, Android/iOS, Terraform/Ansible, GitLab CI/CD.
  - Principles: clear and maintainable architecture, security-first, scalability and reliability, high observability and automation, cloud-native and microservices-oriented design, and a strong focus on performance, resilience, and operational excellence.
  - AI-native by default: we expect AI to be part of how you think, design, build, and test — used deliberately and responsibly.
  
  WHAT SUCCESS LOOKS LIKE:
  Within your first few months, you independently take a real business need through the full cycle — requirements, spec, implementation across the relevant layers, tests, and a production release with observability — at a speed and quality that would traditionally have required a small team, and you help the rest of engineering raise its AI fluency along the way.