About TransFi

TransFi is a global payments and crypto infrastructure company enabling cross-border payments, on/off ramps, and multi-currency accounts through a single API. We’re building the future of global payments — secure, compliant, and developer-friendly.

Role Overview

We are seeking an experienced Application Security Engineer with strong expertise in MERN Stack and AWS Cloud to secure our web applications, APIs, and infrastructure. You will collaborate with our engineering, DevOps, and compliance teams to build a security-by-design culture and ensure our platform adheres to global standards like ISO 27001, SOC 2 Type 2, and PCI DSS.

Key Responsibilities

1. Conduct security reviews for web applications, APIs, and microservices (Node.js, React).
2. Perform threat modeling, code reviews, and vulnerability assessments.
3. Integrate SAST, DAST, and dependency scanning tools into CI/CD pipelines.
4. Manage AWS security posture — IAM, KMS, CloudTrail, WAF, GuardDuty, and Security Hub.
5. Coordinate with DevOps for secure configuration of containers, ECS, and Lambda.
6. Lead incident response and coordinate remediation with development teams.
7. Define and enforce secure coding practices, secrets management, and identity controls.
8. Support audits and compliance initiatives (ISO 27001, SOC 2, PCI DSS).

Required Skills

1. 6–8 years of experience in application or cloud security.
2. Strong understanding of MERN Stack (MongoDB, Express.js, React.js, Node.js) architecture.
3. Hands-on experience securing applications hosted on AWS Cloud.
4. Knowledge of OWASP Top 10, NIST, and CIS benchmarks.
5. Familiarity with tools like Burp Suite, SonarQube, Snyk, Prisma Cloud, or AWS Inspector.
6. Experience with DevSecOps pipelines and security automation.
7. Strong problem-solving and communication skills.

Good to Have

1. Prior experience in fintech, payments, or crypto platforms.
2. Familiarity with container security (ECS, Docker) and Infrastructure as Code (Terraform).
3. Certifications such as AWS Security Specialty, CEH, or CISSP are a plus.