Application Security Engineer
Published on April 16, 2024
Pennylane is building the financial OS (Operating System) for European SMEs. A single source of truth for financial data, used on one side by entrepreneurs to run their business (invoicing and getting paid, paying suppliers and expense management, piloting cash and profitability) and on the other side by their accountant for bookkeeping and fiscal declarations. Saving time to all entrepreneurs and accountants, helping them to make the right decisions and enabling 3rd parties to offer added-value personalized financial services. We’ve launched in France and will expand to other markets in Continental Europe in 2022. Our commercial website is thus in French only but the code is obviously documented in English and our tech team speaks English.
Are you looking to have an impact on the daily life of millions of entrepreneurs in France and Europe?
Do you thrive in a trustful, fast-paced environment?
Do you feel like our Engineering principles are aligned with your vision ?
Then Pennylane might be the right place for you — and you, might be the perfect fit for this role 🙂
Our vision
We aim to become the most beloved financial Operating System of European SMEs.
We help business owners get rid of the time consuming hassle of handling accounting and finance, while giving them access to key information that they can use to make better decisions.
Meanwhile, we’re helping accountants. By using Pennylane, rather than doing manual and repetitive tasks, they can spend more time advising and guiding their clients.
About us
Pennylane is one of the fastest growing Fintechs in France (and soon to be in Europe!)
In 4 years of existence, we’ve managed to :
💻 Make ourselves known as a groundbreaking accounting and financial software for small businesses and their accountants
💰 Raise a total of €84 millions, including from Sequoia 🌲, the famous fund from the Silicon Valley who invested early in companies like Google, Facebook, Airbnb, Stripe, Paypal and much more...
👨👩👧👦 Grow from 7 cofounders to 370+ happy Pennylaners : we’re now recognized as one of the greatest places to work in France (but also remotely), with a 5/5 rating on Glassdoor and an e-NPS of 94.
🌍 Build an international environment with more than 26 nationalities, with a strong remote-friendly culture, where 30% of the employees are already working from all parts of Europe
🤝 Earn the trust of thousands of customers and accounting firms and obtain outstanding ratings
WHY this position is of utmost importance to reach our mission
We are looking for an Application Security Engineer to join Louis and Romain in the technical security team. Reporting directly to Guillaume, our Head of Information Security, you will be responsible for all technical matters involving security issues. Working with the security compliance team, you may be required to provide technical support to the team in the definition and monitoring of long-term projects designed to strengthen the security of our assets in a sustainable manner. You will have a key role in advising, assisting, informing, training and alerting all employees (especially developers). You will also be responsible for the day-to-day management of technical operations in the context of ISO 27001 certification.
The technical security team is involved from the identification/detection of a security issue to its resolution (development and implementation of the security patches). If the needs or the complexity of the patch are too great, the security team can count on the support of the developers and in particular the Security Champions team to sustain the effort.
🎯 Your tasks
You will be required to work on :
- All technical security issues/projects while providing technical support on compliance needs
Let’s break it down ⏬
- Security by design within the projects by discussing with the teams to consider the security risks
- To be proactive in the security projects to be carried out, to define and to prioritize them
- Ensure the security of the main Web application in Ruby on Rails and React: its dependencies, its code, its infrastructure and its configuration
- Security and maintaining the security condition of other applications and AWS infrastructure, including its Kubernetes environment (AWS EKS)
- Conduct and perform regular security assessments (internally or by an external firm) on the applications (code reviews/pentests/bug bounty in particular) and the infrastructure
- Ensure compliance with ISO 27001 controls (processes) related to development (mandatory code practices, validation, patch management, vulnerability management, etc.) by training developers, monitoring projects (tech, product), conducting regular internal audits and managing tech non-conformities
- Conducting code reviews from a secure development point of view (about 80 releases per day, not all of which have security implications, but it is an important and recurring topic)
- Build/Improve secure development training materials and conduct regular training sessions with the developers
- Contribute to tenders to explain our security policies and provide the necessary technical details
Learn about Rails and React to detect vulnerabilities during code reviews and implement associated patches
- Strengthen the current means of detecting malicious attempts
These missions are not exhaustive and remain evolving.
🥇You’re the right candidate if
- You are mid/senior level in defensive or offensive application security, are a quick learner and like to work on different projects. As a security team member at Pennylane, you’ll work on all security topics (application, cloud infrastructure, security by design, training, ISO 27001, etc.).
- Working in an English-speaking environment doesn't scare you, you don't need to be bilingual. You need to be able to share your ideas and thoughts well in spoken and written English and to understand what is being said. If you need help with this, we can provide you with a Busuu subscription to improve your English immediately.
- You ideally have the following skills/experience ⏬
- Able to perform offensive security assessments on an infrastructure or an application
- You know how to exploit and fix a wide range of Web vulnerabilities (not just the OWASP top 10)
- You already have an experience in a programming language (Ruby, Python, JavaScript), either for quick and dirty scripting to exploit a vulnerability or for larger projects
- You have an experience in cloud infrastructure security
- You are able to popularize technical terms to facilitate the adoption of security measures within projects or to broadcast messages to Pennylaners
- You are autonomous, proactive and organized
- Working with remote colleagues is not an issue for you
Bonus: if you have already developed in Ruby or React and/or if you have technical application security certifications. A multi-skilled profile will be preferred.
What do we do to make your work life easier ?
🏢 You’ll be able to work fully from your home or any co-working space in France, or from our wonderful office in the center of Paris
💵 You’ll have a compensation package
📈 You'll get company shares to enjoy a piece of the success story you're building with us
🏝You’ll get between 8 to 13 additional days off (to the 25 standard ones) to rest and do what you love each year
🍜 You’ll have lunch credits (Swile card) to buy your favorite food every day
🏥 You’ll have a great healthcare cover (Alan Blue) to take care of yourself and your family
🏡 You’ll have a budget to turn your home into a more comfortable workspace, as well as a monthly allowance to work from a coworking space whenever you feel like it
⛹️Through our partner Gymlib, you’ll have access to 8000 fitness spaces in Europe and more than 300 activities related to wellness
🇬🇧 You’ll have access to Busuu to perfect your english or your french
💻 You’ll get the latest Apple equipment
🎉 You’ll be part of a vibrant social community : we do lots of sports together (Foot, running, climbing...), we love to hang out and have a drink together (thursday afterwork drinks on our rooftop is a usual thing. Twice-a-year we do company seminars, last time we went on a trip to Centerparcs and it was fabulous !)
We're working on providing those last advantages to our people based outside of France as well, but it can be quite more complex depending on different countries.
What does the recruitment process look like ?
- You will first have a general chat with Thomas (Technical Recruiter) : 30 min
- Then you’ll meet Louis and Romain - Application Security Engineers, a first introduction meeting where you’ll also discover the technical challenge (30min). You carry out independently the technical challenge for the next 48h.
- Then, you’ll discuss about your solutions with Guillaume (Head of Information Security), Louis and Romain - (1h)
- Finally, a last culture fit meeting with one of our co-founders (30min)
We make sure we move fast ; you can expect the recruitment process with us to last between 15 and 25 days in total.
Encouraging diversity in all its forms, Pennylane strives to offer an inclusive, caring and fulfilling work environment in our offices and remotely. We provide equal opportunities and consideration regardless of background, origin, gender, religion, sexual orientation or handicap.