Senior Information Security Engineer (InfoSec Engineer)
A Senior InfoSec Engineer designs and protects the infrastructure and payment services of a fintech company, covering controls, threat monitoring, incident response, and compliance.
What a Senior Information Security Engineer does
The Senior InfoSec Engineer is responsible for the technical security of the company's products and infrastructure: the payment core, customer accounts, partner APIs, cloud environments, CI/CD, and internal systems. In fintech and payments, this work is directly tied to customers' money and to the company's license. A card data leak, a compromised merchant account, or unauthorized withdrawals quickly turn into financial losses, fines, and problems with partner banks and regulators.
This role is especially important in high-risk verticals, where fraud, account takeover, and attacks on payment integrations are common, and requirements for data storage and auditing are strict. Companies use a senior engineer as the technical owner of security. They translate the requirements of standards and regulators into concrete architectural decisions, controls, and verifiable procedures, rather than only writing policies.
Structurally, the role usually sits in the technology function or works closely with the risk function. The Senior InfoSec Engineer reports to the head of information security (Head of InfoSec or CISO) and works with DevOps, backend developers, SRE, and the anti-fraud team. They often lead one or two mid-level engineers or interns and set the technical bar for reviews and design.
Responsibilities
- Design the secure architecture of new payment services and integrations: threat models, data flow analysis, and selection of controls during design reviews
- Configure and maintain security controls: access management, network segmentation, encryption of data at rest and in transit, and secrets and key management
- Build and develop security monitoring: SIEM rules, alerts for anomalies in authorizations and logins, and log coverage of critical systems
- Manage vulnerability management: scanning, prioritization by exploitability and business impact, and tracking remediation deadlines with service owners
- Coordinate penetration testing and bug bounty programs: prepare scope, review findings, and verify fixes
- Take part in incident response: triage, containment, evidence collection, and coordination with lawyers and support during data breaches
- Support compliance with industry standards such as PCI DSS and with internal policies: prepare audit evidence and maintain the control map
- Conduct security reviews of code and pipelines: SAST/DAST, dependency checks, protection of secrets in CI/CD, and service account permissions
- Train developers and product teams in secure development, and run blameless incident postmortems
- Assess the risks of new contractors and providers (processing, KYC providers, cloud) using technical criteria
Skills
- Designing secure architecture for distributed systems and APIs
- Deep understanding of network security, TLS, authentication, and authorization (OAuth, OIDC, MFA)
- Threat modeling and risk assessment based on concrete fraud scenarios
- Incident response and forensic log analysis
- Knowledge of payment industry requirements, such as PCI DSS, and the ability to turn them into technical controls
- Cloud security: IAM, network policies, containers, and Kubernetes
- Writing code and automation in Python, Go, or Bash for checks and response
- Communicating with non-technical stakeholders by explaining risk in terms of money and deadlines, not CVEs
- Mentoring and running technical reviews without pressuring teams
Tools
- SIEM systems (Splunk, Elastic Security, or similar)
- EDR and endpoint protection systems
- Vulnerability scanners and SAST/DAST tools
- Secrets managers and PKI
- Cloud consoles and infrastructure-as-code tools (Terraform)
- Jira or a similar task tracker with vulnerability SLAs
- Access management systems and identity directories (Active Directory, IdP)
- Wiki and runbook storage systems for incidents
How performance is measured
- Mean time to detect and mean time to contain incidents (MTTD and MTTR)
- Share of critical and high vulnerabilities fixed within agreed deadlines
- Coverage of critical services by logging and monitoring
- Number of incidents with financial loss and their trend
- Share of releases that pass security review before deployment
- Audit results and closed control gaps
- Share of penetration test findings fixed without recurrence
By vertical
FinTech
In fintech and payments, the Senior InfoSec Engineer protects not only data but also the movement of money. They design controls for authorizations, withdrawals, changes to payout details, and integrations with processors. Significant attention goes to protecting card data under PCI DSS requirements, managing partner APIs, and countering the compromise of customer and merchant accounts. The work is closely tied to the anti-fraud team and compliance, because many attacks look like legitimate transactions.
Levels
Senior
A senior engineer is responsible for the technical security of the entire area. They make architectural decisions, independently lead complex incidents, and agree on risks with management. They influence development and release processes rather than only executing tasks, and ensure that controls work in practice rather than existing only on paper. They are expected to set their own priorities and be able to defend a solution in front of the business.
How to get there
People usually enter the profession from systems administration, network engineering, backend or DevOps development, SOC analysis, or penetration testing. Practical experience with infrastructure and an understanding of how applications work internally matter most. For fintech, experience with payment systems, high-load services, or regulated industries is useful, though not required.
To grow to senior level, you need to show a systematic approach: design security at the architecture stage, handle incidents from start to finish, and write clear reports and runbooks. It helps to learn PCI DSS requirements and risk management principles, automate checks and monitoring, and work with SIEM and cloud environments. Bug bounty and CTF practice confirms technical skills, but employers value experience protecting real products above all.
The typical path is a junior or mid-level security engineer, then a dedicated area of responsibility (for example, cloud or monitoring), and then a senior role owning a domain. Growth comes through expanding influence: from protecting individual services to architectural decisions across the company, and eventually to managing a team.
Next steps: Lead InfoSec Engineer, Security Architect, Head of Information Security, Principal Security Engineer, Application Security Lead
FAQ
How is a Senior InfoSec Engineer different from a SOC analyst?
A SOC analyst mainly monitors events, investigates alerts, and provides first-line incident response. A Senior InfoSec Engineer is responsible for building and configuring protection: they design controls, write detection rules, manage vulnerabilities, and take part in architecture. Senior engineers often grow out of analyst roles but work at a higher level.
Do I need payment industry experience to get this role in fintech?
Payment experience speeds up entry considerably, because PCI DSS requirements and processing logic differ noticeably from general web development. However, many companies hire strong engineers from related fields and train them in industry requirements on the job. The key criterion is the ability to explain risk in terms of money and consequences for customers.
What determines a Senior InfoSec Engineer's salary in fintech?
Pay depends on the company's size, the jurisdictions it operates in, and the depth of expertise. Cloud security, cryptography, regulator interaction, and incident response are valued differently. The work format (employee or contractor), experience managing a team, and the local market also matter. For exact figures, check current job postings.
What certifications does a Senior InfoSec Engineer need?
There are usually no mandatory formal certifications. Employers more often look at practical experience and results. Industry and general security certifications are common, but their value depends on the specific role and company. It matters more to demonstrate real cases: projects, incidents, and control improvements.
What does a Senior InfoSec Engineer do in the first few months in a new job?
Typically they study the architecture and data flows, map current risks and controls, and review the state of monitoring and access management. In parallel, they build working relationships with development and SRE to understand release processes. Based on this, they create a prioritized improvement plan and agree on it with management.
How does a Senior InfoSec Engineer work with developers who push back on restrictions?
A good engineer builds security as part of development rather than as external control. They provide ready-made templates, automated checks in the pipeline, and clear requirements. They explain risk with concrete examples and offer alternatives that do not slow down releases. Conflicts are usually resolved by prioritizing based on real damage rather than through bans.
Looking for a job in the industry?
Post an anonymous resume in our bot — recruiters from iGaming, payments and crypto search it every day.