Senior QA Engineer – (Security)

About Hyperlayer

Hyperlayer is the intelligent banking platform built for the agentic economy: the financial control layer that sits above banks' existing cores, enabling next-generation Smart Accounts, without ripping anything out. From a single integration, we give financial institutions a secure rules and orchestration engine that lets them design, launch and scale hyper-personalised products in weeks while preserving stability, compliance and control. And there's nothing like us anywhere in the world.

Hyperlayer works with Tier 1 and Tier 2 FIs across the UK, US, EMEA and Hong Kong, with an award-winning UK consumer app (HyperJar) sitting in the group. We're creating the fintech category that every bank in the world needs: programmable, governed, agent-ready accounts. Your job is to make sure our audiences know that.

About the role

• We're hiring a Senior Quality Engineer to lead security testing across Hyperlayer: our platform and

orchestration engine, the APIs banks integrate with, and HyperJar, our consumer app.

• Banks and financial institutions rely on us to keep their customers' money and data safe. Many banks share

one platform, and our accounts are agent-ready, so access control, tenant isolation and delegated

permissions have to be right every time.

• You'll make security testing a routine part of how we build and release: finding issues early, automating

checks in our pipelines, and turning every finding into a regression test.

• You'll bring strong API testing and automation skills in Java and REST Assured, so security tests sit alongside

our functional suites rather than in a separate silo.

• You'll report into the Head of Solution Architecture & QA and work closely with engineering, DevOps, our

Principal Quality Engineer and external penetration testers.

• This role is predominantly office-based in Paddington, London.

What you'll do

• Test our APIs and apps against the OWASP API Security Top 10 and OWASP Top 10, with a focus on

authentication, authorisation and data exposure.

• Make sure one bank can never see or change another bank's data, with automated tenant-isolation checks

for every endpoint.

• Test agent-ready accounts: delegated permissions, spending limits, revocation and the audit trail for every

agent action.

• Build automated security tests in Java and REST Assured, and turn every confirmed finding into a regression

test.

• Add security checks to our CI/CD pipelines, such as DAST (e.g. OWASP ZAP), fuzzing (e.g. ffuf), SAST and

dependency scanning, tuned so they don't create noise.

• Join design reviews and threat modelling for new features, and turn abuse cases into test cases.

• Prepare for external penetration tests, triage their findings with engineering, and verify fixes.

• Test HyperJar's mobile security, including secure storage, authentication and API usage, against OWASP

MASVS.

• Report security risk clearly to inform release go/no-go decisions.

• Help other quality engineers add security checks to their own pods, using AI tools where they help and

keeping client data out of them.Qualifications

Essential

• 5+ years in QA, quality engineering or application security, including at least 3 years of hands-on security

testing of APIs and web applications.

• Strong practical knowledge of the OWASP API Security Top 10 and OWASP Top 10, with real findings you

can talk about.

• Hands-on experience with security testing tools such as OWASP ZAP or Burp Suite.

• Solid understanding of authentication and authorisation: OAuth 2.0, OpenID Connect, JWT, session

handling and role-based access control.

• Strong API testing skills, with experience automating tests in Java (or another JVM language) using REST

Assured or similar.

• Experience adding security testing to CI/CD pipelines (e.g. Jenkins, Bitbucket Pipelines, GitHub Actions) and

triaging scanner findings.

• Ability to explain risk and severity clearly to engineers and non-specialists.

• Comfortable in a fast-moving startup environment, balancing speed with the rigour needed when testing

financial systems.

• Willing and able to be in our London office four days per week.

Desirable

• Experience in banking, payments or another regulated financial services environment, and awareness of

expectations such as FCA rules, DORA or PCI DSS.

• Security certifications such as OSCP, OSWE, eWPT or CREST, or a background in penetration testing.

• Threat modelling experience (e.g. STRIDE).

• Mobile application security testing (OWASP MASVS, MobSF), ideally including Flutter apps.

• Experience testing multi-tenant SaaS platforms or services written in Go.

• Awareness of security risks in AI and agent-based systems, such as the OWASP Top 10 for LLM Applications.

• Cloud and container security experience (AWS, Docker, Kubernetes).

How to apply

Please click on the 'Apply' button, you will be asked to provide an updated CV and answer some questions. For

further information about this vacancy, you can contact us at: recruitment@hyperlayer.com.

We will not be offering UK work visa sponsorship for these roles. Candidates will need an existing non-sponsored

right to work in the UK.

Working at Hyperlayer

At Hyperlayer we are proud of our in-office culture. It makes a real difference to the working atmosphere and

maximises collaboration in and across teams. This is critical to how we work and learn. Also, we think it makes for

a great workplace!

We value our team and are proud to offer some great benefits:

• A performance-based employee bonus scheme.

• 25 days annual leave plus bank holidays, a day off on your birthday, and an additional day per year of

tenure to a maximum of 30.

• Critical illness and life insurance cover.

• AXA PPP Health Insurance, including gym offers.

• Cycle-to-work scheme.

• Referral bonus scheme.

• Workplace nursery scheme.

Equity, diversity, and inclusion

Hyperlayer's mission is to make a positive impact on people's lives, making it easier for everyone to manage their

money.Hyperlayer's commitment to equity, diversity, and inclusion is a key part of this; it helps us better serve our

customers, employees, and business partners from every background.

We are constantly learning and striving to do better, and we expect all staff to actively take part in this process.

Data Privacy

As part of our recruitment process, Hyperlayer Limited collects and processes personal data relating to job

applicants.

We are committed to being transparent about how we collect and use this data and to meeting our data

protection obligations.