T

Toss

Fintech super-app for payments and banking

Penetration Testing and Vulnerability Analysis Specialist - Security Researcher

Security Engineering & Architecture +1Confirmed live in the last 24 hours
Full-timeSeoul, South KoreaNo salary listedIn-person

About the Job

Requirements

  • Deeply analyze and resolve security issues in at least one area such as web, APIs, mobile, cloud, or devices.
  • Analyze source code and system architecture, and explain vulnerability causes, attack conditions, and service impact with supporting evidence.
  • Implement security research findings directly in code, tools, or automation and apply them in real work.
  • Propose practical improvements and collaborate with development teams through remediation and verification.
  • Set the scope and priorities of assigned work, learn unfamiliar technologies, and drive problems to resolution.

Responsibilities

  • Perform vulnerability assessments and penetration tests on services, APIs, mobile apps, cloud environments, and payment terminals; analyze source code and system behavior to verify vulnerability causes and real-world impact.
  • Conduct threat modeling and security reviews for new services and major design changes; address recurring issues such as authentication, authorization, and data access through common designs and reusable security features.
  • Analyze communications, firmware, and update structures for mobile apps and payment terminals, improve security designs, and participate in required security certification efforts.
  • Develop and enhance a security platform that tracks service and API changes, deployment changes, attack surfaces, vulnerabilities, owners, and remediation status.
  • Integrate code analysis, secret detection, and open-source supply-chain checks into CI/CD to establish security checks from development through deployment; evaluate, build or adopt tools, apply them, and improve them.
  • Use AI and large language models to automate code analysis, security reviews, and vulnerability impact analysis; verify analysis accuracy and safety and improve the efficiency of recurring work and review resources.
  • Research the impact of newly disclosed vulnerabilities and attack techniques on Toss Place; prioritize risks by impact and work with development teams on remediation, revalidation, and recurrence prevention.
  • Divide product areas and projects with the existing Security Researcher and lead research, design, implementation, rollout, and effectiveness verification in assigned areas.
  • Collaborate with development teams, Security Engineers, and DevOps to turn research findings into product improvements and changes to development processes.

Desired Qualifications

  • Experience with security analysis or reverse engineering of native or cross-platform mobile apps, payment terminals, Android Open Source Project, or firmware.
  • Experience designing or implementing reusable security features for multiple services, such as shared authentication and authorization, API access control, or data protection.
  • Experience applying code analysis, secret detection, supply-chain security checks, or other controls to CI/CD, cloud, or container environments.
  • Experience using AI or large language models for security analysis automation, or reviewing the security of AI services and agents.
  • Experience developing security tools or platforms, or evaluating and adopting commercial or open-source tools and owning their operation and improvement.
  • Experience sharing research externally through bug bounty programs, CVEs, security research presentations, or open-source contributions.

About the Company

Toss

Fintech super-app for payments and banking

Toss is a South Korean financial services platform that started as a peer-to-peer money transfer service and has grown into a digital 'super app' for personal finance. Its products are accessed through one mobile interface that unifies bank accounts, credit cards, loans, investments, and other financial services, including its own Toss Bank and Toss Securities. It differentiates itself by offering a broad, integrated ecosystem—combining digital banking, asset management, and brokerage services under one roof and running its own banking and securities units. Its goal is to become the leading consumer finance platform in South Korea while expanding its user base globally.

Company size
1,001-5,000
Company stage
Series G
Total funding
$1.5B
Headquarters
Seoul, South Korea
Founded
2011

Recently Posted Jobs

Explore more opportunities at Toss

See more jobs