The

Senior Application Security Engineer

is responsible for helping secure the Paymentus SaaS platform by partnering directly with software engineering, product, cloud infrastructure, DevOps, and security teams to identify, assess, and remediate application security risks across web applications, RESTful APIs, microservices, cloud-native services, and AI-enabled application components. This is a hands-on technical role reporting to the

Manager of Platform Security . The Senior Application Security Engineer will perform secure design reviews, threat modeling, source code review, API security assessments, application security testing, vulnerability validation, and remediation guidance for applications and services that support Paymentus’ payment technology platform. The successful candidate must have strong hands-on software development experience, deep knowledge of modern application security, and the ability to work effectively with engineering teams to improve security without unnecessarily slowing product delivery. This role requires practical expertise in SaaS application security, RESTful API security, cloud-native application patterns, secure coding, software supply chain risk, and emerging AI/LLM application security risks. Essential Functions/

Responsibilities

Perform application security reviews for Paymentus SaaS platform applications, services, APIs, and supporting application infrastructure. Partner with software engineering teams to embed security into the software development lifecycle, including requirements, architecture, design, development, testing, deployment, and post-release operations. Conduct threat modeling and secure architecture reviews for web applications, RESTful APIs, microservices, cloud-native services, AI-enabled features,



and integrations with internal and external systems. Review source code and application design for services written primarily in

Java, NodeJS, Python, and Golang . Assess application security risks in frameworks and platforms including, but not limited to,

Spring, Struts, Express, Flask, Django, FastAPI, LiteLLM , and related open-source or commercial application frameworks. Identify, validate, and help remediate common application security vulnerabilities, including injection flaws, broken access control, authentication weaknesses, authorization bypasses, insecure deserialization, SSRF, XXE, XSS, CSRF, business logic flaws, insecure file handling, secrets exposure, and sensitive data leakage. Perform API security assessments for RESTful APIs, including review of authentication, authorization, object-level access control, function-level access control, input validation, rate limiting, excessive data exposure, resource consumption controls, versioning, and API inventory management. Apply up-to-date application security guidance, including

OWASP Top 10 ,

OWASP API Security Top 10 , and

OWASP Top 10 for Large Language Model Applications , to practical engineering scenarios. Assess AI and LLM-enabled application components from an application security perspective, including risks such as prompt injection, insecure output handling, sensitive information disclosure, excessive agency,



insecure tool or plugin integration, model abuse, and AI supply chain concerns. Provide secure design guidance for applications using LLM gateways, model orchestration layers, retrieval-augmented generation, AI agents, third-party AI services, and frameworks such as

LiteLLM . Support security reviews of application servers, web servers, reverse proxies, and related runtime components, including

Tomcat, JBoss, nginx , and similar technologies. Review application and API security controls deployed through edge and CDN platforms such as

Cloudflare

and

Fastly , including WAF rules, bot mitigation, rate limiting, caching behavior, header controls, TLS configuration, and origin protection. Assess application security implications of cloud-native deployments across

AWS, GCP, and Azure , including identity and access management, secrets handling, encryption, workload isolation, logging, service-to-service communication, and secure configuration. Review application deployment patterns involving

Kubernetes , containers, container registries, CI/CD pipelines, infrastructure as code, and serverless technologies. Help define and improve secure coding standards, application security requirements, design patterns, reusable security controls, developer guidance, and security review procedures. Perform manual and automated application security testing using tools and techniques such as SAST, DAST, SCA, container image scanning, IaC scanning, secrets detection, API security testing, dependency analysis, and manual penetration-style validation. Validate security findings for exploitability, business impact, severity, compensating controls, and appropriate

📌 Senior Application Security Engineer (Winnipeg)
🏢 Paymentus
📍 Winnipeg