Security Engineer, Application Security
Listed on 2026-06-23
-
IT/Tech
Cybersecurity, Security Manager, Data Security
Are you ready to trade your job for a journey? Become a Fly Mate!
Passion, excitement & global collaboration are all core to what it means to be a Fly Mate. At Flywire, we’re on a mission to deliver the world’s most important and complex payments. We use our Flywire Advantage—the combination of our next‑gen payments platform, proprietary payment network and vertical specific software—to help our clients get paid and help their customers pay with ease—no matter where they are in the world.
What more do we need to truly be unstoppable? Perhaps, that is you!
Who we areFlywire is a global payments enablement and software company, founded more than a decade ago to solve high‑stakes, high‑value payments in higher education. We’ve since scaled into new regions and industry verticals and expanded our product offerings to deliver meaningful value to our clients around the world.
Today we support more than 5,100 clients across the global education, healthcare, travel & B2B industries, with diverse payment methods across 240 countries & territories and more than 140 currencies.
With over 1,200 global Fly Mates, representing more than 40 nationalities, and in 12 offices worldwide, we’re looking for Fly Mates to join the next stage of our journey as we continue to grow.
Job TitleSecurity Engineer, Application Security
Salary Range$109,221 – $114,221/year
Job Location141 Tremont St, 10th Floor, Boston, MA 02111;
Telecommuting permissible from any location within US
Responsible for ensuring the security of applications and software systems developed and used within the organization. This role involves conducting application security reviews, performing secure code analysis, integrating security testing into CI/CD pipelines, and guiding developers on secure coding practices. Design and implement security protocols for Healthcare, EDU, and B2B applications, conducting regular threat modeling and vulnerability assessments to identify and mitigate risks, and developing and deploying cryptographic solutions to protect sensitive data.
Analyze and interpret student‑related data from Indian and Chinese markets to inform strategies for mitigating payer fraud and enhancing security for international student transactions. Telecommuting permissible from any location within US.
Master’s degree or foreign equivalent in Computer Science with a specialization in Information Security, or a related field, and one (1) year of experience in computer science, information security, application security or a closely related role.
Risk Management:
Perform comprehensive vulnerability management and risk assessments using industry tools such as Tenable and Qualys. Deliver actionable reports with remediation guidance and continuously monitor and triage alerts with SIEM platforms including Splunk, Sumo Logic, ELK, and Wazuh.
Conduct hands‑on application security testing using a variety of SAST, SCA, and DAST tools, including Veracode, Burp Suite, Snyk, Semgrep, OWASP ZAP, Arachni, Sonar Qube, and OWASP Dependency‑Check.
Develop and review secure applications in programming languages such as Ruby on Rails, Java, Python, and Go, focusing on modern UI web interfaces (e.g., JavaScript, ReactJS, AngularJS, Node.js). Ensure adherence to secure coding standards (OWASP Top 10) and protect against threats like XSS and SQL injection.
Conduct peer code reviews, perform in-depth threat modeling using methodologies like STRIDE, and execute security architecture assessments to proactively identify and mitigate risks throughout the software development lifecycle.
Embed security into CI/CD pipelines, specifically within Git Lab, by writing custom jobs and rules. Integrate and automate security tools like Trivy and Semgrep to ensure continuous security checks and early vulnerability detection within a Dev Sec Ops framework.
Securely handle sensitive data using credential management tools like Hashi Corp Vault. Design and implement strong cryptographic…
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).