Senior Cybersecurity

About the role
Billease operates consumer lending, merchant checkout, and digital banking products handling sensitive financial and personal data at scale. We run a cloud-native, microservices architecture on AWS/EKS, built primarily in Go and Python, backed by PostgreSQL/Aurora, Kafka, and ClickHouse, with native Android and iOS apps.
We're looking for a hands-on Senior Cybersecurity Specialist who can break our systems before anyone else does — and then help us build them so they can't be broken. This is a deeply technical, offensive-minded role that also drives secure-by-design practices across engineering. You'll run penetration tests, hunt for exploitable flaws across our apps, APIs, protocols, and infrastructure, and bring a modern, AI-augmented approach to finding and triaging security issues at scale.
This is an individual-contributor role with significant influence. You will not be managing a team — you will be the person engineers and leadership turn to for the hard security questions.

What you'll do
Plan and execute penetration tests and red-team exercises against web apps, mobile apps, APIs, microservices, cloud infrastructure, and internal tooling.
Perform mobile application security testing (Android & iOS) — static and dynamic analysis, runtime instrumentation, SSL pinning bypass, local storage and secrets review, and reverse engineering.
Discover and prove exploitability of vulnerabilities across network and application protocols (TLS, HTTP/2, gRPC, OAuth2/OIDC, SAML, WebSocket, DNS, mTLS), producing working PoCs and clear remediation guidance.
Review cryptographic implementations — key management, TLS configuration, token signing/encryption, data-at-rest and in-transit protections — and catch misuse of crypto primitives.
Conduct secure code review (Go/Python) and threat modeling for new services and features; embed security gates into our GitLab CI/CD pipelines.
Build and operate AI-assisted security workflows — automating recon, triage, code analysis, and vulnerability detection to scale coverage across ~85 engineers' output.
Harden our AWS/EKS environment: IAM, network segmentation, Kubernetes security posture, container and supply-chain security, secrets management.
Lead vulnerability management — prioritize, track, and verify remediation; reduce false positives and mean-time-to-fix.
Support compliance and regulatory needs (PCI DSS, BSP requirements, Data Privacy Act / NPC) with evidence, controls testing, and risk assessments.
Respond to incidents: investigate, contain, perform root-cause analysis, and drive preventative fixes.
Mentor engineers and raise the organization's overall security maturity through guidance, tooling, and training.

Core requirements
Experience
5+ years in offensive security, application security, or security engineering, with a strong hands-on penetration-testing background.
Demonstrated track record of finding, exploiting, and responsibly reporting real vulnerabilities (CVEs, bug bounty, or documented engagements a plus).
Experience securing cloud-native, microservices environments in production — ideally fintech, banking, or another regulated, high-trust domain.

Hands-on experience with security tooling
You should be fluent with the categories below and the leading tools in each (we don't expect every single tool, but we expect deep command of most categories):

Web app testing
Burp Suite (Pro), OWASP ZAP, Nikto, sqlmap, Acunetix
Network & vuln scanning
Nmap, Nessus, OpenVAS, Qualys, Nexpose, Masscan
Exploitation / red team
Metasploit, Cobalt Strike, Sliver, Impacket, BloodHound
Mobile security
MobSF, Frida, Objection, Drozer, apktool, jadx, Hopper, Corellium, Xcode/Android Studio
Reverse engineering
Ghidra, IDA Pro, radare2 / Cutter, Binary Ninja
Fuzzing
AFL++, libFuzzer, boofuzz, Jazzer
SAST / DAST / SCA
Semgrep, SonarQube, Checkmarx, Fortify, Snyk, Bandit (Python), gosec (Go)
Cloud & Kubernetes security
Prowler, ScoutSuite, kube-bench, kube-hunter, Falco, Trivy, Checkov, tfsec/Terrascan
Container & supply chain
Trivy, Grype, Clair, Anchore, Cosign / Sigstore
Secrets scanning
Gitleaks, TruffleHog
Traffic & protocol analysis
Wireshark, tcpdump, mitmproxy
Credential attacks
Hashcat, John the Ripper, Hydra
SIEM / detection
Splunk, Elastic Security (ELK), Wazuh

Mobile application security testing
Proven experience testing Android and iOS apps end to end.
Static and dynamic analysis, runtime hooking/instrumentation (Frida/Objection), SSL/TLS pinning bypass, tamper and root/jailbreak-detection analysis.
Reverse engineering of APKs/IPAs; review of insecure local storage, hardcoded secrets, insecure IPC, and deep-link abuse.
Familiarity with the OWASP MASVS / MASTG mobile security standards.

Security standards & frameworks
OWASP — Top 10, ASVS, API Security Top 10, MASVS/MASTG, SAMM.
PCI DSS (critical for our payment and lending flows).
NIST — CSF, SP 800-53, SP 800-63 (digital identity).
ISO/IEC 27001 / 27002, CIS Controls & Benchmarks, SOC 2.
Awareness of BSP regulatory expectations and the Philippine Data Privacy Act (RA 10173 / NPC).

Cryptography
Solid, practical understanding of modern cryptography and, just as importantly, how it gets misused:
Symmetric: AES (GCM, CBC, modes & IV/nonce pitfalls), ChaCha20-Poly1305.
Asymmetric: RSA, ECC (ECDSA, EdDSA/Ed25519, ECDH).
Hashing & KDFs: SHA-2/3, HMAC, bcrypt, scrypt, Argon2, PBKDF2.
Key exchange & PKI: Diffie-Hellman/ECDH, TLS 1.2/1.3, certificate lifecycle, mTLS.
Tokens: JWT/JWS/JWE — signing, encryption, and common vulnerabilities (alg confusion, weak keys, replay).
Key management and secrets with AWS KMS / HSM.

Protocol exploitation
Ability to analyze and find exploitable flaws in network and application protocols: TCP/IP, TLS/SSL, HTTP/HTTPS, HTTP/2, gRPC, WebSocket, DNS, mTLS.
Attacking authentication/authorization protocols — OAuth 2.0, OIDC, SAML (token theft, scope abuse, redirect and confusion attacks).
API security testing across REST, GraphQL, and gRPC (IDOR/BOLA, mass assignment, injection, rate-limit and business-logic abuse).

AI-driven security (advanced specialty)
We want someone who treats AI as a force multiplier for security work — not a buzzword. You should be able to demonstrate a concrete AI workflow for finding a security issue. For example:
Example workflow we'd expect you to speak to (or demo live):
Ingest a target service's source (Go/Python) and OpenAPI/proto definitions.
Agentic analysis — drive an LLM agent (e.g., via scripted tool-calling) to map data flows, identify untrusted inputs, and flag candidate vulnerability classes (injection, auth bypass, SSRF, IDOR).
Correlate LLM findings against SAST output (Semgrep/gosec/Bandit) to cut false positives and rank by exploitability.
Generate and validate a PoC — have the agent draft an exploit request, run it against a staging target, and confirm the issue dynamically.
Produce a remediation diff and a human-readable report

Additional AI-security expectations:
Using LLMs for code review, log/anomaly triage, and detection-rule generation.
Understanding LLM/AI system security itself — prompt injection, data exfiltration, model/supply-chain risks (OWASP Top 10 for LLM Applications), relevant to our own AI features.
Programming
Strong Python or \ Go skills — you build your own tooling, automate testing, and read/debug our production services. (Our stack is Go + Python, so you'll be reviewing real code, not just running scanners.)
Comfortable with Bash, Git/GitLab CI, Docker, and Kubernetes manifests.

Nice to have
Prior experience in fintech, banking, or payments under PCI DSS.
Bug bounty track record or published research / CVEs.
Experience with Kafka, ClickHouse, or event-driven architectures from a security standpoint.
Detection engineering and threat hunting experience.
Infrastructure-as-code security (Terraform) and cloud security automation.

What success looks like (first 6 months)
Delivered at least one full-scope pentest across our mobile + API surface with prioritized, remediated findings.
Security gates integrated into CI/CD with measurably fewer false positives.
A working AI-assisted triage/analysis workflow in use by the team.
A clear, risk-ranked view of our top vulnerabilities and a tracked path to closing them.