sqa engineer

software engineer

backend developer

.net developer

it support engineer

security developer

TeamUpdraft

<p></p><div><p><b>Here&rsquo;s who we are:</b></p><p>
At Team Updraft our DNA is in world-leading software for WordPress that helps our customers to backup, restore, clone, secure and optimize their WordPress websites. Our global team is behind some of the most popular WordPress plugins in the world! Used by more than 5 million WordPress website owners, our plugins have a reputation for being reliable and powerful.</p><p></p><p>
We have an exciting opportunity for a<b> Lead Developer</b> to join us, to be successful in this role you will have <b>deep knowledge and experience developing WordPress</b>, and a <b>passion for security with demonstrable experience</b> in this area.</p><p></p><p>
You will have the option to choose your own hours from 32 up to 40 per week, and you can work remotely from anywhere in the world, we simply ask that you have 4 hours of crossover with UK working hours per day.<br>
<br>
&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&ndash;</p><p><b>
Lead Developer (all-in-one-security)</b></p><p><b>
Competitive Salary (depending on experience)</b></p><p><b>
Fully Remote</b></p><p></p><p>
We have an exciting opportunity for a Web Developer with excellent PHP, JS and WordPress experience to join a growing, ambitious team to help further develop one of the world&rsquo;s leading WordPress security plugins - All-In-One Security: WordPress Security Plugin (aiosplugin.com)</p><p></p><p><br>
AIOS is responsible for protecting over 1 million websites worldwide. You will play a leading role in the company&rsquo;s aim to continue to be the dominant player in the plugin industry.</p><p></p><p><br>
You will be working together with a small, global team involved in development and testing. Overseeing the development and maintenance of the AIOS plugin, ensuring features are delivered to a high standard and guiding the work of the other developers.</p><p></p><p><b><br>
The day-to-day role</b></p><ul>
<li>Work in PHP, JavaScript and WordPress libraries to write clean, efficient and secure code</li>
<li>Line managing the plugin development team</li>
<li>Ensuring tasks are appropriately assigned, reviewed, and completed by the team</li>
<li>Maintaining high technical standards in the code base</li>
<li>Utilising senior developer&rsquo;s knowledge to achieve the best direction for the plugin</li>
<li>Identifying priorities, resolving blockers</li>
<li>Acting as the key point of contact for technical queries related to the plugin</li>
<li>Liaising with QA and Product Managers to align development work with wider business goals</li></ul><p><br>
</p><p>Your exact responsibilities will depend on your experience, how this fits with other members of the team and subject to discussion and agreement!</p><p><b>
Requirements</b></p><p></p><p><b>
You&rsquo;ll definitely need experience with:</b></p><ul>
<li><b>PHP </b>&ndash; you'll have experience of developing in WordPress, ideally on the development of a plugin.</li>
<li><b>JavaScript</b> &ndash; a smaller part of the role, but important.</li>
<li><b>Online security</b> - keeping up to date with the latest threats and security issues that relate to websites.</li>
<li><b>Firewalls </b>or other related security technologies.</li>
<li><b>Managing other developers</b></li><br>
</ul><p><b>It would be nice if you have experience with:</b></p><p>
GitHub / GitLab / Git &ndash; nice to have, but can be learnt quickly by good developers used to alternatives like SVN.</p><p><b>
Benefits</b></p><p><b>
Why Join Us?</b></p><p>
We are a globally distributed, highly flexible team that values autonomy and impact. You'll have the freedom to manage your own time and work from anywhere in the world (with the exception of Antarctica!). While we primarily work remotely, we also offer:</p><ul>
<li>The option to work from our co-working space in Newport, Wales, if you're UK-based.</li>
<li>Opportunities to connect with the team at annual WordCamp events across Europe, Asia, or the US.</li>
<li>Regular online connections through 1:1s, team meetings, and company updates.</li>
</ul><p></p><p>We believe in flexible working and are open to discussing various arrangements &ndash; whether you're looking for freelance, employed, part-time, full-time, permanent, or contract work, we're keen to find the right fit for the right candidate.</p><p></p><p>
If you're ready to make a significant impact as our new Lead Developer for our AIOS Plugin and help us shape the future of TeamUpdraft, we encourage you to apply!</p></div><p></p>

Lead Developer (all-in-one-security) - WordPress

<div>
 <strong>
  Here's who we are:
  <br/>
  <br/>
 </strong>
 At Team Updraft our DNA is in world-leading software for WordPress that helps our customers to backup, restore, clone, secure and optimize their WordPress websites. Our global team is behind some of the most popular WordPress plugins in the world! Used by more than 5 million WordPress website owners, our plugins have a reputation for being reliable and powerful.
 <br/>
 <br/>
 We have an exciting opportunity for a
 <strong>
  Lead Developer
 </strong>
 to join us, to be successful in this role you will have
 <strong>
  deep knowledge and experience developing WordPress
 </strong>
 , and a
 <strong>
  passion for security with demonstrable experience
 </strong>
 in this area.
 <br/>
 <br/>
 You will have the option to choose your own hours from 32 up to 40 per week, and you can work remotely from anywhere in the world, we simply ask that you have 4 hours of crossover with UK working hours per day.
 <br/>
 <br/>
 &mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;&mdash;-
 <br/>
 <br/>
 <strong>
  Lead Developer (all-in-one-security)
  <br/>
  <br/>
 </strong>
 <strong>
  Competitive Salary (depending On Experience)
  <br/>
  <br/>
 </strong>
 <strong>
  Fully Remote
  <br/>
  <br/>
 </strong>
 We have an exciting opportunity for a Web Developer with excellent PHP, JS and WordPress experience to join a growing, ambitious team to help further develop one of the world's leading WordPress security plugins - All-In-One Security: WordPress Security Plugin (aiosplugin.com)
 <br/>
 <br/>
 AIOS is responsible for protecting over 1 million websites worldwide. You will play a leading role in the company's aim to continue to be the dominant player in the plugin industry.
 <br/>
 <br/>
 You will be working together with a small, global team involved in development and testing. Overseeing the development and maintenance of the AIOS plugin, ensuring features are delivered to a high standard and guiding the work of the other developers.
 <br/>
 <br/>
 <strong>
  The day-to-day role
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Work in PHP, JavaScript and WordPress libraries to write clean, efficient and secure code
  </li>
  <li>
   Line managing the plugin development team
  </li>
  <li>
   Ensuring tasks are appropriately assigned, reviewed, and completed by the team
  </li>
  <li>
   Maintaining high technical standards in the code base
  </li>
  <li>
   Utilising senior developer's knowledge to achieve the best direction for the plugin
  </li>
  <li>
   Identifying priorities, resolving blockers
  </li>
  <li>
   Acting as the key point of contact for technical queries related to the plugin
  </li>
  <li>
   Liaising with QA and Product Managers to align development work with wider business goals
   <br/>
   <br/>
  </li>
 </ul>
 Your exact responsibilities will depend on your experience, how this fits with other members of the team and subject to discussion and agreement!
 <br/>
 <br/>
 <strong>
  Requirements
  <br/>
  <br/>
 </strong>
 <strong>
  You'll definitely need experience with:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   PHP - you'll have experience of developing in WordPress, ideally on the development of a plugin
  </li>
  <li>
   JavaScript - a smaller part of the role, but important
  </li>
  <li>
   Online security - keeping up to date with the latest threats and security issues that relate to websites
  </li>
  <li>
   Firewalls or other related security technologies
  </li>
  <li>
   Managing other developers
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  It would be nice if you have experience with:
  <br/>
  <br/>
 </strong>
 GitHub / GitLab / Git - nice to have, but can be learnt quickly by good developers used to alternatives like SVN.
 <br/>
 <br/>
 <strong>
  Benefits
  <br/>
  <br/>
 </strong>
 <strong>
  Why Join Us?
  <br/>
  <br/>
 </strong>
 We are a globally distributed, highly flexible team that values autonomy and impact. You'll have the freedom to manage your own time and work from anywhere in the world (with the exception of Antarctica!). While we primarily work remotely, we also offer:
 <br/>
 <br/>
 <ul>
  <li>
   The option to work from our co-working space in Newport, Wales, if you're UK-based
  </li>
  <li>
   Opportunities to connect with the team at annual WordCamp events across Europe, Asia, or the US
  </li>
  <li>
   Regular online connections through 1:1s, team meetings, and company updates
   <br/>
   <br/>
  </li>
 </ul>
 We believe in flexible working and are open to discussing various arrangements - whether you're looking for freelance, employed, part-time, full-time, permanent, or contract work, we're keen to find the right fit for the right candidate.
 <br/>
 <br/>
 If you're ready to make a significant impact as our new Lead Developer for our AIOS Plugin and help us shape the future of TeamUpdraft, we encourage you to apply!
</div>


Contour Software

<div><div>About Contour</div><div></div><div><div>
Contour Software</div> has grown from a dozen people to over 2,000 staff across 3 cities, in less than 14 years.</div><div><br>
As a subsidiary of Constellation Software Inc., we are proud to be part of a global enterprise software conglomerate that has grown to become one of the top 10 software companies in the world, with employees and customers in 100+ countries. With a broad-based and ever-growing portfolio of market-leading, vertical-market enterprise solutions covering more than 100 industry domains in predominantly mature markets, CSI's recipe creates the perfect environment for professionals to build fulfilling, long-term careers.</div><div><br>
What started as an R&amp;D &amp; Accounting back-office, has progressed into a full-service Global Centre serving all functions and departments, at the divisional as well as operating group/corporate level. Today Contour employees, located in Karachi, Lahore &amp; Islamabad, are serving CSI divisions located in time zones spanning the globe, from Sydney to Vancouver. With the global growth of Constellation as the wind in our sails, we are only just getting started!</div><div></div><div>
About the Role:</div><div><div>
Constellation Payment</div> Processing is a modern Payment Facilitator (PayFac) empowering SaaS businesses to grow revenue through seamless, embedded payments. As part of Constellation Software Inc. (TSE:CSU) &mdash; a global Canadian-based software leader at a $96B market cap and the 7th largest software company in the world &mdash; we combine the agility of a specialized payments company with the strength and stability of an established global powerhouse.</div><div>
We&rsquo;re building a cloud-native PayFac platform on AWS: microservices (DDD) across TypeScript/JavaScript, Java, and Ruby, with a ReactJS front end. As our Security Engineer, you&rsquo;ll co-own the DevSecOps program&mdash;driving continuous security automation, compliance automation, and penetration testing. You&rsquo;ll design and orchestrate SAST/SCA/DAST across our services, champion remediation practices, and partner closely with our compliance team to translate control objectives into repeatable, automated evidence.</div><div></div><div>
Our customers are ISV vendors who embed payments by integrating with our APIs, SDKs, and webhooks. That means security and compliance aren&rsquo;t afterthoughts&mdash;they&rsquo;re product features. You&rsquo;ll ensure our developer-facing surface area is secure by default: establishing standards for authentication and authorization (OIDC/OAuth2/JWT, mTLS/JWS for webhooks), key and secret management, request signing, idempotency, rate-limiting/abuse controls, and secure data handling that minimizes PCI scope for ISVs (tokenization, hosted fields/iframes, PAN vault boundaries, network tokens). You&rsquo;ll create secure integration patterns (reference apps, checklists, threat models/DFDs) so partners can implement quickly without compromising controls.</div><div></div><div>
Because we operate a multi-tenant PayFac, you&rsquo;ll harden isolation boundaries (network, identity, and data), lead supply-chain security (SBOMs, signing/provenance, gated deployments), and build continuous evidence for PCI DSS 4.0 (and SOC 2/ISO as needed). You&rsquo;ll collaborate with partner security and compliance teams on due-diligence requests (SIG Lite, AOC/ROCs, shared-responsibility matrices), and you&rsquo;ll own pre-launch security reviews for new ISV integrations. You&rsquo;ll also help run incident response drills and define partner-facing comms and SLAs for security events.</div><div></div><div>
Finally, you&rsquo;ll research and implement AI-assisted security (triage, anomaly detection, auto-remediation PRs) with appropriate guardrails, and own KPIs that demonstrate multiplier effects&mdash;e.g., reduced MTTR, lower false-positive rates, higher auto-triage coverage, and faster time-to-evidence&mdash;so our platform&rsquo;s security posture continuously improves as our ISV ecosystem scales.</div><div></div><div>
What You&rsquo;ll Do:</div><div></div><div>
Own Security Automation:</div><ul><li><div>
Design, implement, and run the CI/CD security toolchain: SAST, SCA, DAST, container and IaC scanning, secrets detection, SBOM generation, and policy-as-code.</div></li><li><div>
Integrate scanners into GitHub/GitHub Actions pipelines with PR gates, and auto-ticketing to JIRA; tune noise, baselines, and break-glass rules.</div></li><li><div>
Establish vulnerability management SLAs, risk acceptance workflow, and metrics dashboards (e.g., MTTR, vuln burn-down).</div></li></ul><div></div><div>
Embed Security in the SDLC:</div><ul><li><div>
Create lightweight secure-coding standards and review checklists for TypeScript/Node, Java, Ruby, React.</div></li><li><div>
Run threat modeling (STRIDE/PASTA) and produce DFDs (L0&ndash;L2) for new and high-risk flows.</div></li><li><div>
Lead a &ldquo;security champions&rdquo; program with engineering squads.</div></li></ul><div></div><div>
Platform &amp; Cloud Security (AWS/EKS):</div><ul><li><div>
Harden EKS workloads (admission controls, pod security, image signing, runtime protection), ECR scanning, and supply-chain security.</div></li><li><div>
Implement and iterate on IAM least-privilege, KMS/CloudHSM key management, network segmentation, WAF/Shield, CloudFront, GuardDuty/Security Hub, and centralized logging.</div></li><li><div>
Validate service-to-service auth (mTLS, OIDC, JWT), secrets management (AWS Secrets Manager/SSM), and data protection at rest/in transit (FIPSvalidated crypto).</div></li><li><div>
Manage security certificate adoption our own and 3rd party across the company technology stack</div></li></ul><div></div><div>
Compliance Automation:</div><ul><li><div>
Map controls and automate evidence for PCI DSS 4.0 (and SOC 2/ISO 27001 as needed): continuous monitoring, detector-to-control mappings, and audit-ready artifacts.</div></li><li><div>
Partner with compliance on policies, risk register, third-party/vendor assessments, and control testing cadence.</div></li></ul><div></div><div>
Penetration Testing &amp; Response:</div><ul><li><div>
Scope and coordinate internal and third-party penetration tests (API, web, mobile, cloud); plan fix-verification and retests.</div></li><li><div>
Contribute to incident response playbooks, tabletop exercises, and forensics runbooks.</div></li><li><div>
Participate in incident response events and be a key contributor on improving security posture</div></li></ul><div></div><div>
Research &amp; implement AI security tools:</div><ul><li><div>
Evaluate and deploy AI/ML capabilities (LLM-assisted code reviews, AI triage for SAST/SCA/DAST, anomaly detection over logs/telemetry, drift detection) to reduce toil and increase signal quality&mdash;without leaking sensitive code or data.</div></li></ul><div></div><div>
Own outcomes &amp; KPIs:</div><ul><li><div>
Define baselines, instrument dashboards, and continuously tune models/policies to demonstrably improve detection efficacy, remediation speed, and compliance evidence quality.</div></li></ul><div></div><div>
Guardrails &amp; governance:</div><ul><li><div>
Establish safe-use patterns (PII redaction, repository allowlists, prompt/content controls, human-in-the-loop), document model/feature risks, and keep audit trails that map to PCI DSS 4.0 controls.</div></li></ul><div></div><div>
Automation &amp; SOAR integration:</div><ul><li><div>
Orchestrate AI-assisted enrichment and response (e.g., auto-labeling, deduplication, prioritization, suggested fixes/PRs) across CI/CD, SIEM, ticketing, and chat.</div></li></ul><div></div><div>
KPIs You&rsquo;ll Own:</div><ul><li><div>
MTTR for high-severity vulns/incidents: 40&ndash;60% vs. baseline within 2&ndash;3 quarters.</div></li><li><div>
Alert noise reduction (precision/FP rate): 50% reduction in false positives on gated scans and detections.</div></li><li><div>
Auto-triage coverage: 70% of scanner findings enriched and prioritized by AI with reviewer acceptance 90%.</div></li><li><div>
AI-generated remediation PRs: 30% of low/medium issues fixed via assisted PRs passing CI policy.</div></li><li><div>
Time-to-evidence (PCI 4.0 controls): 50% for recurring audits via automated control artifacts.</div></li><li><div>
Signed-off service coverage: 90% of services covered by AI-backed detections and scan triage.</div></li></ul><div></div><div>
What You&rsquo;ll Bring:</div><ul><li><div>
8&ndash;10 years in application/cloud security or DevSecOps for high-availability platforms (fintech/payments ideal).</div></li><li><div>
Hands-on DevSecOps program administration experience with Veracode.</div></li><li><div>
Fluent in Terraform for the AWS Stack</div></li><li><div>
Strong CI/CD experience (GitHub Actions preferred) and automation in Python/TypeScript/Bash.</div></li><li><div>
Solid AWS security fundamentals: IAM, KMS, CloudTrail, Config, Security Hub, GuardDuty, VPC/LBs, WAF/Shield; Kubernetes/EKS hardening experience.</div></li><li><div>
Familiarity with microservices, event-driven systems, and DDD; ability to read code in TypeScript/Java/Ruby and basic ReactJS patterns.</div></li><li><div>
Working knowledge of PCI DSS 4.0 control objectives (tokenization/PAN handling, key management, segmentation, logging/retention), plus SOC 2/ISO 27001 concepts.</div></li><li><div>
Clear communication with engineers and non-technical stakeholders; bias to automate and simplify.</div></li><li><div>
Bonus Point: Payments domain exposure: EMV/3DS, PAN vaulting, network tokenization, P2PE, dispute/chargeback flows.</div></li></ul><div></div><div>
How We&rsquo;ll Measure Success:</div><ul><li><div>
90 days: Security scans embedded in CI for core services with actionable findings; baseline metrics and SLAs defined; initial PCI 4.0 control mappings complete.</div></li><li><div>
6 months: False-positive rate &lt;10% on gating scans; P1/P2 MTTR within SLA; SBOMs &amp; dependency policies enforced; security champions running.</div></li><li><div>
12 months: Compliance evidence automation covers priority controls; successful third-party penetration test with timely remediation; measurable reduction in highrisk vulns and misconfigurations.</div></li></ul><div></div><div>
Team &amp; Reporting:</div><div></div><div>
This role sits in the CTO organization (Engineering/Platform) and partners daily with compliance, DevOps/SRE, Backend/Frontend teams, and Product.</div><div></div><div>
Our Stack (you don&rsquo;t need all of these):</div><div></div><div>
AWS (EKS, ECR, KMS, CloudHSM, WAF/Shield, CloudFront, GuardDuty, Security Hub,</div><div>
CloudWatch), GitHub/GitHub Actions, Terraform, Node/TypeScript, Java, Ruby, React,</div><div>
Kafka, MongoDB, Postgres, Redis, Veracode, OWASP ZAP/Burp, AI Tools in Microsoft Teams, JIRA, Development IDEs (Amazon Q, Cursor, Claude Code)</div><div>
Exciting Benefits we offer:</div><ul><li><div>
Market-leading Salary</div></li><li><div>
Medical Coverage &ndash; Self &amp; Dependents</div></li><li><div>
Parents Medical Coverage</div></li><li><div>
Provident Fund</div></li><li><div>
Employee Performance-based bonuses</div></li><li><div>
Home Internet Subsidy</div></li><li><div>
Conveyance Allowance</div></li><li><div>
Profit Sharing Plan [Tenured Employees Only]</div></li><li><div>
Life Benefit</div></li><li><div>
Child Care Facility</div></li><li><div>
Company Provided Lunch/Dinner</div></li><li><div>
Professional Development Budget</div></li><li><div>
Recreational area for in-house games</div></li><li><div>
Sporadic On-shore training opportunities</div></li><li><div>
Friendly work environment</div></li><li><div>
Leave Encashment</div></li></ul><div></div><div><i>
Disclaimer:</i><i> At Contour, we attribute our success to the unique contributions of our diverse staff. We&rsquo;re committed to fostering a culture of respect that thrives on the varied perspectives and experiences of all individuals we recruit, employ, promote, and compensate. Since day one, we&rsquo;ve adhered to a policy that champions a work environment honoring the worth and dignity of each person while being free from all forms of employment discrimination.</i></div><div></div><div><i>
In our continuous effort to promote inclusivity, we extend our commitment to individuals with special needs by providing reasonable accommodations. We actively encourage qualified individuals with special needs to apply for the various openings within our company. Should you require assistance in completing the application process or have any inquiries regarding special facilities, please do not hesitate to contact our HR team. Your unique talents and abilities are welcomed and valued here.</i></div></div><div></div>

Security Engineer (DevSecOps)

<div>
 <strong>
  About Contour
  <br/>
  <br/>
 </strong>
 Contour Software has grown from a dozen people to over 2,000 staff across 3 cities, in less than 14 years.
 <br/>
 <br/>
 As a subsidiary of Constellation Software Inc., we are proud to be part of a global enterprise software conglomerate that has grown to become one of the top 10 software companies in the world, with employees and customers in 100+ countries. With a broad-based and ever-growing portfolio of market-leading, vertical-market enterprise solutions covering more than 100 industry domains in predominantly mature markets, CSI's recipe creates the perfect environment for professionals to build fulfilling, long-term careers.
 <br/>
 <br/>
 What started as an R&amp;D &amp; Accounting back-office, has progressed into a full-service Global Centre serving all functions and departments, at the divisional as well as operating group/corporate level. Today Contour employees, located in Karachi, Lahore &amp; Islamabad, are serving CSI divisions located in time zones spanning the globe, from Sydney to Vancouver. With the global growth of Constellation as the wind in our sails, we are only just getting started!
 <br/>
 <br/>
 <strong>
  About The Role
  <br/>
  <br/>
 </strong>
 Constellation Payment Processing is a modern Payment Facilitator (PayFac) empowering SaaS businesses to grow revenue through seamless, embedded payments. As part of Constellation Software Inc. (TSE:CSU) &mdash; a global Canadian-based software leader at a $96B market cap and the 7th largest software company in the world &mdash; we combine the agility of a specialized payments company with the strength and stability of an established global powerhouse.
 <br/>
 <br/>
 We&rsquo;re building a cloud-native PayFac platform on AWS: microservices (DDD) across TypeScript/JavaScript, Java, and Ruby, with a ReactJS front end. As our Security Engineer, you&rsquo;ll co-own the DevSecOps program&mdash;driving continuous security automation, compliance automation, and penetration testing. You&rsquo;ll design and orchestrate SAST/SCA/DAST across our services, champion remediation practices, and partner closely with our compliance team to translate control objectives into repeatable, automated evidence.
 <br/>
 <br/>
 Our customers are
 <strong>
  ISV vendors
 </strong>
 who embed payments by integrating with our APIs, SDKs, and webhooks. That means security and compliance aren&rsquo;t afterthoughts&mdash;they&rsquo;re product features. You&rsquo;ll ensure our
 <strong>
  developer-facing surface area
 </strong>
 is secure by default: establishing standards for authentication and authorization (OIDC/OAuth2/JWT, mTLS/JWS for webhooks), key and secret management, request signing, idempotency, rate-limiting/abuse controls, and secure data handling that
 <strong>
  minimizes PCI scope
 </strong>
 for ISVs (tokenization, hosted fields/iframes, PAN vault boundaries, network tokens). You&rsquo;ll create
 <strong>
  secure integration patterns
 </strong>
 (reference apps, checklists, threat models/DFDs) so partners can implement quickly without compromising controls.
 <br/>
 <br/>
 Because we operate a multi-tenant PayFac, you&rsquo;ll harden isolation boundaries (network, identity, and data), lead
 <strong>
  supply-chain security
 </strong>
 (SBOMs, signing/provenance, gated deployments), and build
 <strong>
  continuous evidence
 </strong>
 for
 <strong>
  PCI DSS 4.0
 </strong>
 (and SOC 2/ISO as needed). You&rsquo;ll collaborate with partner security and compliance teams on due-diligence requests (SIG Lite, AOC/ROCs, shared-responsibility matrices), and you&rsquo;ll own pre-launch security reviews for new ISV integrations. You&rsquo;ll also help run incident response drills and define
 <strong>
  partner-facing comms and SLAs
 </strong>
 for security events.
 <br/>
 <br/>
 Finally, you&rsquo;ll
 <strong>
  research and implement AI-assisted security
 </strong>
 (triage, anomaly detection, auto-remediation PRs) with appropriate guardrails, and own KPIs that demonstrate multiplier effects&mdash;e.g., reduced MTTR, lower false-positive rates, higher auto-triage coverage, and faster time-to-evidence&mdash;so our platform&rsquo;s security posture continuously improves as our ISV ecosystem scales.
 <br/>
 <br/>
 <strong>
  What You&rsquo;ll Do
  <br/>
  <br/>
 </strong>
 <strong>
  Own Security Automation:
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Design, implement, and run the CI/CD security toolchain: SAST, SCA, DAST, container and IaC scanning, secrets detection, SBOM generation, and policy-as-code.
  </li>
  <li>
   Integrate scanners into GitHub/GitHub Actions pipelines with PR gates, and auto-ticketing to JIRA; tune noise, baselines, and break-glass rules.
  </li>
  <li>
   Establish vulnerability management SLAs, risk acceptance workflow, and metrics dashboards (e.g., MTTR, vuln burn-down).
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Embed Security In The SDLC
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Create lightweight secure-coding standards and review checklists for TypeScript/Node, Java, Ruby, React.
  </li>
  <li>
   Run threat modeling (STRIDE/PASTA) and produce DFDs (L0&ndash;L2) for new and high-risk flows.
  </li>
  <li>
   Lead a &ldquo;security champions&rdquo; program with engineering squads.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Platform &amp; Cloud Security (AWS/EKS)
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Harden EKS workloads (admission controls, pod security, image signing, runtime protection), ECR scanning, and supply-chain security.
  </li>
  <li>
   Implement and iterate on IAM least-privilege, KMS/CloudHSM key management, network segmentation, WAF/Shield, CloudFront, GuardDuty/Security Hub, and centralized logging.
  </li>
  <li>
   Validate service-to-service auth (mTLS, OIDC, JWT), secrets management (AWS Secrets Manager/SSM), and data protection at rest/in transit (FIPSvalidated crypto).
  </li>
  <li>
   Manage security certificate adoption our own and 3rd party across the company technology stack
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Compliance Automation
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Map controls and automate evidence for PCI DSS 4.0 (and SOC 2/ISO 27001 as needed): continuous monitoring, detector-to-control mappings, and audit-ready artifacts.
  </li>
  <li>
   Partner with compliance on policies, risk register, third-party/vendor assessments, and control testing cadence.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Penetration Testing &amp; Response
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Scope and coordinate internal and third-party penetration tests (API, web, mobile, cloud); plan fix-verification and retests.
  </li>
  <li>
   Contribute to incident response playbooks, tabletop exercises, and forensics runbooks.
  </li>
  <li>
   Participate in incident response events and be a key contributor on improving security posture
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Research &amp; Implement AI Security Tools
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Evaluate and deploy AI/ML capabilities (LLM-assisted code reviews, AI triage for SAST/SCA/DAST, anomaly detection over logs/telemetry, drift detection) to reduce toil and increase signal quality&mdash;without leaking sensitive code or data.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Own Outcomes &amp; KPIs
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Define baselines, instrument dashboards, and continuously tune models/policies to demonstrably improve detection efficacy, remediation speed, and compliance evidence quality.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Guardrails &amp; Governance
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Establish safe-use patterns (PII redaction, repository allowlists, prompt/content controls, human-in-the-loop), document model/feature risks, and keep audit trails that map to PCI DSS 4.0 controls.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  Automation &amp; SOAR Integration
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Orchestrate AI-assisted enrichment and response (e.g., auto-labeling, deduplication, prioritization, suggested fixes/PRs) across CI/CD, SIEM, ticketing, and chat.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  KPIs You&rsquo;ll Own
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   MTTR for high-severity vulns/incidents: &darr; 40&ndash;60% vs. baseline within 2&ndash;3 quarters.
  </li>
  <li>
   Alert noise reduction (precision/FP rate): &ge; 50% reduction in false positives on gated scans and detections.
  </li>
  <li>
   Auto-triage coverage: &ge; 70% of scanner findings enriched and prioritized by AI with reviewer acceptance &ge; 90%.
  </li>
  <li>
   AI-generated remediation PRs: &ge; 30% of low/medium issues fixed via assisted PRs passing CI policy.
  </li>
  <li>
   Time-to-evidence (PCI 4.0 controls): &darr; 50% for recurring audits via automated control artifacts.
  </li>
  <li>
   Signed-off service coverage: &ge; 90% of services covered by AI-backed detections and scan triage.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  What You&rsquo;ll Bring
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   8&ndash;10 years in application/cloud security or DevSecOps for high-availability platforms (fintech/payments ideal).
  </li>
  <li>
   Hands-on DevSecOps program administration experience with Veracode.
  </li>
  <li>
   Fluent in Terraform for the AWS Stack
  </li>
  <li>
   Strong CI/CD experience (GitHub Actions preferred) and automation in Python/TypeScript/Bash.
  </li>
  <li>
   Solid AWS security fundamentals: IAM, KMS, CloudTrail, Config, Security Hub, GuardDuty, VPC/LBs, WAF/Shield; Kubernetes/EKS hardening experience.
  </li>
  <li>
   Familiarity with microservices, event-driven systems, and DDD; ability to read code in TypeScript/Java/Ruby and basic ReactJS patterns.
  </li>
  <li>
   Working knowledge of PCI DSS 4.0 control objectives (tokenization/PAN handling, key management, segmentation, logging/retention), plus SOC 2/ISO 27001 concepts.
  </li>
  <li>
   Clear communication with engineers and non-technical stakeholders; bias to automate and simplify.
  </li>
  <li>
   Bonus Point: Payments domain exposure: EMV/3DS, PAN vaulting, network tokenization, P2PE, dispute/chargeback flows.
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  How We&rsquo;ll Measure Success
  <br/>
  <br/>
 </strong>
 <li>
  90 days: Security scans embedded in CI for core services with actionable findings; baseline metrics and SLAs defined; initial PCI 4.0 control mappings complete.
 </li>
 6 months: False-positive rate &lt;10% on gating scans; P1/P2 MTTR within SLA; SBOMs &amp; dependency policies enforced; security champions running.
 <li>
  12 months: Compliance evidence automation covers priority controls; successful third-party penetration test with timely remediation; measurable reduction in highrisk vulns and misconfigurations.
  <br/>
  <br/>
 </li>
 <strong>
  Team &amp; Reporting
  <br/>
  <br/>
 </strong>
 This role sits in the
 <strong>
  CTO organization
 </strong>
 (Engineering/Platform) and partners daily with compliance, DevOps/SRE, Backend/Frontend teams, and Product.
 <br/>
 <br/>
 <strong>
  Our Stack (you Don&rsquo;t Need All Of These)
  <br/>
  <br/>
 </strong>
 AWS (EKS, ECR, KMS, CloudHSM, WAF/Shield, CloudFront, GuardDuty, Security Hub,
 <br/>
 <br/>
 CloudWatch), GitHub/GitHub Actions, Terraform, Node/TypeScript, Java, Ruby, React,
 <br/>
 <br/>
 Kafka, MongoDB, Postgres, Redis, Veracode, OWASP ZAP/Burp, AI Tools in Microsoft Teams, JIRA, Development IDEs (Amazon Q, Cursor, Claude Code)
 <br/>
 <br/>
 <strong>
  Exciting Benefits We Offer
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Market-leading Salary
  </li>
  <li>
   Medical Coverage &ndash; Self &amp; Dependents
  </li>
  <li>
   Parents Medical Coverage
  </li>
  <li>
   Provident Fund
  </li>
  <li>
   Employee Performance-based bonuses
  </li>
  <li>
   Home Internet Subsidy
  </li>
  <li>
   Conveyance Allowance
  </li>
  <li>
   Profit Sharing Plan [Tenured Employees Only]
  </li>
  <li>
   Life Benefit
  </li>
  <li>
   Child Care Facility
  </li>
  <li>
   Company Provided Lunch/Dinner
  </li>
  <li>
   Professional Development Budget
  </li>
  <li>
   Recreational area for in-house games
  </li>
  <li>
   Sporadic On-shore training opportunities
  </li>
  <li>
   Friendly work environment
  </li>
  <li>
   Leave Encashment
   <br/>
   <br/>
  </li>
 </ul>
 <strong>
  <em>
   Disclaimer:
  </em>
 </strong>
 <em>
  At Contour, we attribute our success to the unique contributions of our diverse staff. We&rsquo;re committed to fostering a culture of respect that thrives on the varied perspectives and experiences of all individuals we recruit, employ, promote, and compensate. Since day one, we&rsquo;ve adhered to a policy that champions a work environment honoring the worth and dignity of each person while being free from all forms of employment discrimination.
  <br/>
  <br/>
 </em>
 <em>
  In our continuous effort to promote inclusivity, we extend our commitment to individuals with special needs by providing reasonable accommodations. We actively encourage qualified individuals with special needs to apply for the various openings within our company. Should you require assistance in completing the application process or have any inquiries regarding special facilities, please do not hesitate to contact our HR team. Your unique talents and abilities are welcomed and valued here.
 </em>
</div>


Miletap

<p><b>Location:</b> Clifton Block 5<br/><b>Job Type : </b>Onsite</p><p><b>About the Role</b></p><p>We are looking for a motivated <b>Software Security Intern</b> to support our engineering and security teams in building, testing, and securing software applications. This role is ideal for someone passionate about cybersecurity, coding, and learning real-world security practices.</p><p><b>Key Responsibilities</b></p><ul><li>Assist in identifying and reporting potential security vulnerabilities in codebases and applications.</li><li>Support the team in performing security testing (static/dynamic analysis, penetration testing, fuzzing, etc.).</li><li>Help implement secure coding practices and review pull requests for basic security issues.</li><li>Research emerging security threats, tools, and techniques and summarize findings for the team.</li><li>Document security processes, testing results, and recommended fixes.</li><li>Collaborate with developers, DevOps, and QA teams to ensure secure software delivery.</li></ul><p><b>Requirements</b></p><ul><li>Currently pursuing or recently completed a degree in <b>Computer Science, Software Engineering, Cybersecurity, or related field</b>.</li><li>Basic understanding of common security vulnerabilities (e.g., OWASP Top 10).</li><li>Familiarity with at least one programming language (e.g., Python, Java, C/C++, JavaScript).</li><li>Knowledge of software development lifecycle (SDLC) and secure coding concepts.</li><li>Strong analytical and problem-solving skills.</li><li>Eagerness to learn and adapt quickly in a fast-paced environment.</li></ul><p><b>What You&rsquo;ll Gain</b></p><ul><li>Hands-on experience in application and software security.</li><li>Mentorship from experienced software engineers and security professionals.</li><li>Opportunity to contribute to real-world projects and improve your portfolio.</li><li>Potential for full-time opportunity based on performance.</li></ul><p>Job Type: Internship</p><p>Work Location: In person</p>

Software Security Intern

WeBytez

<p><b>Location: Gulshan e Iqbal</b></p><p><b>Shift: Night</b></p><p>We are looking to hire a skilled WordPress developer to design and implement attractive and functional websites for our clients. You will be responsible for both back-end and front-end development including the implementation of WordPress themes and plugins as well as site integration and security updates.</p><p><b>WordPress Developer Responsibilities:</b></p><ul><li>Designing and building the website front-end.</li><li>Creating the website architecture.</li><li>Designing and managing the website back-end including database and server integration.</li><li>Generating WordPress themes and plugins.</li><li>Conducting website performance tests.</li><li>Troubleshooting content issues.</li><li>Monitoring the performance of the live website.</li></ul><p><b>WordPress Developer Requirements:</b></p><ul><li>Proven work experience as a WordPress developer.</li><li>Good understanding of website architecture and aesthetics.</li><li>Ability to manage projects.</li></ul><p>Job Type: Full-time</p><p>Pay: Rs50,000.00 - Rs60,000.00 per month</p><p>Work Location: In person</p>

WordPress Developer

Digital Bizkart

<p><b>Role: Android App Developer &ndash; Data Collection App</b></p><p>Full-Time - On Site - Main Shahrah-e-Faisal PECHS Block 6, Karachi</p><p>Project Based: 3 to 4 months</p><p>About the Role</p><p>We are hiring a Project-Based Android App Developer to design and build a Data Collection App for field marketing activations. The app will work offline with GPS tracking, enabling on-ground teams to capture accurate marketing data. This is a 3 to 4 month project, ideal for a developer who enjoys building complete solutions from the ground up.</p><p><b>Key Responsibilities</b></p><ul><li>Develop a robust Android mobile application for offline data collection with GPS integration.</li><li>Design intuitive UI/UX for easy field usage by on-ground staff.</li><li>Build both frontend and backend systems to ensure smooth data flow.</li><li>Set up database and system architecture for secure and scalable data handling.</li><li>Develop an Admin Panel for management and monitoring.</li><li>Implement verification &amp; backchecking modules to ensure data accuracy.</li><li>Create reporting &amp; analytics dashboards for insights and decision-making.</li><li>Ensure security &amp; compliance of stored and transmitted data.</li><li>Conduct testing &amp; quality assurance to deliver a reliable, bug-free app.</li></ul><p><b>Requirements &amp; Skills</b></p><ul><li>Strong experience in Android application development (Java/Kotlin).</li><li>Proven expertise in UI/UX design principles for mobile apps.</li><li>Knowledge of backend frameworks (Node.js, Django, etc.) and API integrations.</li><li>Hands-on experience with databases (MySQL, PostgreSQL, Firebase, or similar).</li><li>Experience building admin dashboards &amp; reporting tools.</li><li>Familiarity with GPS tracking, offline data syncing, and mobile security standards.</li><li>Strong background in testing, debugging, and performance optimization.</li><li>Ability to work independently and deliver high-quality, scalable solutions.</li></ul><p>Job Types: Full-time, Contract</p><p>Pay: Rs150,000.00 - Rs200,000.00 per month</p><p>Work Location: In person</p>

Mobile App Developer

Explore 457+ Security developer in Karachi this October. Find roles across top companies and apply now to boost your career.

457 security developer jobs IN Karachi

Lead Developer (all-in-one-security) - WordPress

Lead Developer (all-in-one-security) - WordPress

Security Engineer (DevSecOps)

Security Engineer (DevSecOps)

Software Security Intern

WordPress Developer

Mobile App Developer