Senior Application Security Engineer

Get to know us

Do you want to help us shape what the future of work will look like and how it will best embrace our life's aspirations? If this sounds like a journey you want to embark on, we may have the right role for you! PayFit is an intuitive software as a service payroll and HRIS solution designed specifically for SMBs. Since 2015, we have set ourselves a mission to simplify payroll for SMBs and enable employers and employees to grow together. We are a European company operating from 3 main countries (France, Spain, and the UK) where we are supporting over 20,000 clients.

Creating a fulfilling work environment and culture is also a core mission at PayFit, and our day-to-day work philosophy is reflected in our four values:

Care: We genuinely care for others whoever they are, whatever they think.

Excellence: We aim to improve and achieve better results every day.

Humility: Staying humble and exchanging transparent feedback helps us to grow and improve.

Passion: We are the architects of PayFit's success.

A key part of our culture, and essential for our success, is also improving the diversity of our teams and building an inclusive culture where you can be yourself at work.

This is why our recruitment focuses on the skills you demonstrate, and not only on your academic background or previous professional experiences. At PayFit we understand that you can gain applicable skills through a variety of life experiences and we are interested in knowing them, too.

Location :
You can work at this role from any location in France or Spain, with occasional visits to the Paris office.

Position Overview :

We're looking for a Senior Application Security Engineer to join our Application Security team, part of the Engineering Platform tribe.

You'll be the AppSec engineer closest to our product engineering teams, not the gatekeeper at the end of the pipeline, but the partner who helps developers ship secure software by default. You'll drive a meaningful shift-left across the SDLC, mentor the rest of the security team, and bring an offensive mindset to how we test our own applications, including how we leverage AI to pentest them.

This is a senior individual contributor role with strong influence. You'll work alongside another Security Engineer and our Compliance Analysts, and partner daily with infrastructure, platform, and product engineering teams to keep PayFit secure as we scale across Europe.

Your mission : 

Shift security left across the SDLC

Embed security into how PayFit builds software. Partner with product teams from design to deployment; threat modeling new features, reviewing architecture decisions, performing code reviews, and helping developers internalize secure-by-default patterns. Make security a multiplier, not a bottleneck.

Drive offensive testing of our applications, including with AI

Run internal application pentests with an attacker mindset and explore how AI can be used to scale and deepen our offensive testing, from automated reconnaissance to AI-assisted vulnerability discovery on our own codebase and APIs. Turn findings into concrete remediation plans and reusable detection patterns.

Secure the SDLC in the age of AI

Help define how PayFit builds software securely when AI is part of the toolchain, from AI-assisted code generation in developer workflows to agentic systems we operate internally. Contribute to guardrails, review patterns, and threat models for AI-augmented development and AI features in our product.

Build and operate AppSec tooling

Deploy and maintain security tooling across our CI/CD pipelines: SAST, SCA, container and image scanning, secrets detection, and supply chain controls. Build automation in TypeScript to scale security across our AWS and K8S/EKS estate, integrating with our existing toolchain (GitHub, CircleCI, Spacelift, Wiz, Datadog, Jira).

Grow the team and the security culture

Mentor the other members of the Security & Compliance team and raise the security bar across engineering. Lead