About Paidy Inc.
Paidy is Japan's pioneer and leading BNPL service company. At Paidy, we believe in creating simple, instant experiences to take the hassle out of shopping with a touch of magic.
Paidy offers instant, monthly-consolidated credit to consumers by removing hassles from payment and purchase experiences. Paidy uses proprietary models and machine learning to underwrite transactions in seconds and guarantee payments to merchants. Paidy increases revenue for merchants by reducing the number of incomplete transactions, increasing conversion rates, boosting average order values, and facilitating repeat purchases from consumers.
Paidy has reached an agreement to join PayPal, the global payments company. Paidy will continue to operate its existing business, maintain its brand and support a wide variety of consumer wallets and marketplaces by providing convenient and innovative services.
Paidy continues to innovate to make shopping easier and more fun both online and offline. For more information, please visit http://www.paidy.com.
About the Position
Cybersecurity is everyone’s responsibility, but our security team leads the charge on solving some of the most challenging and consequential problems facing our organization and industry. As a fintech company operating within a larger corporate group, we navigate a dynamic regulatory landscape while integrating our security program with our parent company’s broader initiatives.
The AppSec & Mobile Cybersecurity Lead is responsible for designing, implementing, and scaling security across Paidy’s iOS and Android applications, mobile APIs, and backend services. This role hardens the systems that power our consumer and merchant experiences by embedding security into the software development lifecycle, building automation that scales with engineering velocity, and staying ahead of an evolving threat landscape that now includes AI-driven attacks and AI-generated fraud. The successful candidate will collaborate closely with mobile engineering, platform, and compliance teams, as well as external auditors and our parent company’s security teams.
Key Role & Responsibilities
Application & Mobile Security Architecture:
- Define and enforce application and mobile security standards across iOS/Android apps, mobile APIs, backend services, and the SDLC
- Lead AppSec and mobile security architecture, ensuring strong access controls, secure data handling, resilient client-server interactions, and appropriate platform-level protections
- Partner with mobile and backend engineering teams to design secure-by-default services that balance usability, fraud and abuse resistance, and privacy requirements
- Conduct threat modeling to proactively identify and mitigate risks across the mobile and application stack
- Own the design and security of REST and GraphQL APIs, with a solid command of the OAuth2 protocol and mobile authentication flows
CI/CD Security & Automation:
- Build and scale security testing within CI/CD pipelines: SAST, SCA, DAST, secrets scanning, container scanning, IaC checks, MAST, binary analysis, and SBOMs for mobile build infrastructure
- Integrate security gates into CircleCI and GitHub workflows, ensuring security findings are surfaced early and tracked to resolution
- Build custom security tooling to automate recurring security validation, coverage measurement, and control verification tasks
- Own container image and runtime scanning across mobile and application build infrastructure
Vulnerability Management & Threat Landscape:
- Own the vulnerability management lifecycle for applications and mobile: triage SLAs, risk ratings, remediation guidance, verification, and recurring root-cause fixes through secure coding patterns and hardened libraries
- Monitor the mobile and application threat landscape (e.g. OWASP MASVS/MSTG, OWASP Top 10, API threats, and mobile fraud patterns) and translate intelligence into actionable engineering priorities
- Track and respond to emerging AI-era threats including LLM and agent supply chain attacks, prompt injection, model abuse in integrated AI features, and AI-generated fraud patterns targeting mobile payment flows
- Communicate vulnerability risk and remediation posture clearly to engineering teams and security leadership
Compliance Support:
- Support audit and compliance programs including SOC 2 (Type 1 and Type 2), ISO 27001, the Japan Act on the Protection of Personal Information (APPI), and the Japan Installment Sales Act (割賦販売法)
- Provide AppSec and mobile security evidence, control mapping, and remediation tracking in support of internal and external audits led by the GRC & Cybersecurity Lead
- Develop and maintain secure coding standards and application security policies in collaboration with engineering and compliance stakeholders
Engineering Enablement & AI-Augmented Tooling:
- Mentor engineering teams on secure design patterns, mobile hardening, and threat-aware development
- Build and maintain security automation using scripting, workflow tools, and AI coding tools including Claude Code to scale security coverage, reduce manual burden, and track KPI and KRI metrics
- Leverage AI-driven tooling to continuously validate security controls, detect regressions, and surface risk trends across the application and mobile estate
- Deliver security awareness and enablement programs tailored to mobile and application engineers
Skills & Requirements
Required Qualifications & Experience:
- 5+ years of experience in application security, mobile security, or DevSecOps with demonstrated technical depth
- Strong hands-on Android and iOS development and security hardening expertise
- Experience with end-to-end vulnerability management including SAST, SCA, and DAST tooling
- Proven experience building security controls into CI/CD pipelines on AWS
- Experience with container scanning (image and runtime) and infrastructure as code security checks
- Solid understanding of the OAuth2 protocol and experience designing and securing REST and GraphQL APIs at scale
- Broad software development experience in one or more of: Rust, Scala, Python, Java, or equivalent modern languages
- Extensive experience with AWS cloud security across common services (API Gateway, Lambda, ECS, RDS, and related)
- Confidence with Docker and Terraform as development and infrastructure tools
- Hands-on experience using AI coding tools (e.g., Claude Code) to build or automate security workflows
- Effective communicator with a pragmatic approach to security — able to build strong relationships with engineering and business stakeholders
- Business-level English required; Japanese language ability is helpful but not required
- B.S. in Computer Science, Information Security, or a related field, or equivalent practical experience
Desired Qualifications & Experience:
- Japanese language proficiency (JLPT 2 or above)
- Experience securing mobile payments or fintech applications in regulated environments
- Demonstrated history of building custom internal security tools, not only consuming commercial products
- Familiarity with the Japanese regulatory environment including APPI and the Installment Sales Act (割賦販売法)
- Prior experience defending mobile platforms at scale against fraud, abuse, and automated attacks
The Paidy team will ask about your user experiences with the Paidy App during the interview. Please download the Paidy App and try it out!
- iOS:
- Android: https://play.google.com/store/apps/details?id=com.paidy.paidy&hl=en&gl=US
For those who are not able to download the Paidy App, due to the regional restrictions, please be advised that you download the similar App, such as Klarna, Afterpay, Affirm and so forth, and come up with your opinions on these applications and services.
Please note that you must be eligible to work in Japan.
What We Offer You
- Diversified team with 230+ colleagues from 35+ countries
- Exciting work opportunities in a rapid-growing organization
- Cross-functional collaboration
- Hybrid remote work model - minimum 2 times in office per week (subject to change at company discretion)
- Competitive salary and benefits
Paidy Values
Be a winner / 勝ちにこだわる
- Always seek to beat expectations. / 期待値を超える為に常に努力する。
- Display surprising speed and resourcefulness. / 人をスピードと機知で驚かす。
- Overcome weaknesses by leveraging the strength and help of others to win. / 仲間の強みを活かしたり協力を得ることで、自身の弱みや足りない点を克服する。
Own it and deliver, together / 共に結果を出す
- Fully support the final decision even if at times you may disagree. / たとえ意見が対立することがあったとしても、最終決定を全面的に受け入れ支持する。
- Acknowledge and gather the power of others, by communicating and collaborating with them. / 仲間の力を認めて活用し、積極的にコミュニケーションをとり、協力する。
- Show a will to own actions and go the extra mile without being asked. / 行動について強いオーナーシップを持ち、言われずとも業務を遂行しきる覚悟を持つ。
Be a valuable team member / 価値を認められるメンバーになる
- Strive to play an integral role. / 替えの効かない役割を果たす。
- Embrace and bridge differences in perspective, language, and culture. / 異なる意見・考え方、言語と文化の架け橋になる。
- Don’t compromise - raise the bar for yourself and others. / スタンダードを上げ続けることに妥協しない。