Information Security Engineer, DLP & Insider Risk

MoonPay is for builders with something to prove.

This isn't a "work on cool crypto stuff" company. It's a high-standards, high-velocity, high-accountability company building the operating system for value movement. If the internet moves information, we move value: crypto, stablecoins, tokenized assets, and whatever comes next. Four offerings make that real: fund, tokenize, trade, and spend. 30M+ customers and 500+ ecosystem partners run on us. Licensed in the U.S. Regulated across the UK, EU, Canada, and Australia.

AI is the default operating mode here. It's woven into every role, and we expect you to use it daily. It handles the manual work so you can deliver on what actually matters.

You'll thrive here if outcomes excite you more than process, if impact motivates you more than titles, and if you want hard problems, real ownership, and teammates who love winning, building, and doing it together.

The bar is high. The pace is real. We're building for what's next, for humans and agents.

Recent recognition:

• India, Bengaluru

• This role will be in the office.

• Working hours: 6:30 PM to 3:30 AM IST

The Security Operations (SecOps) team at MoonPay is dedicated to ensuring the security and integrity of our systems and data in an increasingly complex digital landscape. Comprising a diverse group of professionals from various regions around the globe, our multicultural team brings together a wealth of expertise and perspectives to tackle security challenges effectively. 

Our mission is to identify and mitigate vulnerabilities and threats while maintaining strict compliance with security policies and relevant regulations. By leveraging advanced security measures and proactive threat detection techniques, we work diligently to safeguard our infrastructure and protect our customers’ information. 

In collaboration with the IT team and other departments, we foster a culture of security awareness, sharing best practices and ensuring that everyone at MoonPay understands their role in maintaining a secure environment. 

Our key responsibilities include incident response, security monitoring, endpoint security, VPN,  vulnerability management, data leak protection and third-party risk management (TPRM), all of which contribute to our overarching goal: to create a secure environment for our employees, clients and partners. 

Join us in our commitment to security excellence and help us build a safer future in the blockchain and payments industry!

We are looking for an Information Security Engineer, DLP & Insider Risk, to join our Information Security team, focused on protecting sensitive data and reducing insider risk across the organization. In this role, you will own our Data Loss Prevention program end to end, build out our Insider Risk and UEBA capabilities, and contribute to incident response. You are a hands-on individual contributor who is comfortable working across technical tooling, process development, and cross-functional collaboration.

• →

• Deploy, configure, optimize, and maintain Mimecast Code42, Slack, Google Workspace to protect against data exfiltration.

• Design and roll out technical controls to prevent data leakage from endpoints across email, browsers, and messaging applications.

• Implement and manage Google Workspace Data Loss Prevention policies and Labels.

• Apply a solid understanding of GRC frameworks, data management principles, and data classification schemes to inform DLP strategy and policy.

• Familiarity with UEBA concepts and the ability to correlate signals from SaaS platforms, endpoints, and email security tools to identify and investigate risky user behavior.

• Develop and manage a pre-hire insider risk process in partnership with Talent Acquisition to identify risk signals early in the hiring pipeline.

• Build and maintain a defensive program to address deepfake threats, including detection capabilities, incident response procedures, and employee awareness.

• Collaborate with the Security Awareness team to promote healthy data-sharing practices across the organization.

• Actively participate in Security Operations activities as an L2 Incident Responder.

• Lead incidents through all stages: identification, containment, eradication, recovery, and lessons learned. 

• Serve as the primary point of contact for the SOC regarding SIEM investigations, platform behavior, detection logic, and operational troubleshooting.

• Support continuous improvement by translating incident learnings into better detections, dashboards, and playbooks.

👉 Describe the ideal candidate’s qualifications, skills, experience, and behaviours that show strong culture alignment.

You’re an Information Security Engineer who can both build and operate at scale. You have strong expertise in DLP and are equally comfortable with leading incident response.

You will be working primarily on the following stack: Apple systems, Google Workspace, Slack, Mimecast Code42, Okta, Crowdstrike, Cloudflare WARP, Tenable Nessus and Jamf Pro.

• 3–5 years of experience in information security, with a focus on data protection, DLP, or insider threat.

• Experience building and operationalizing DLP programs, including policy development, tuning detection rules, managing alerts, and documenting response runbooks for data exfiltration scenarios.

• Working knowledge of GRC principles, data classification frameworks, and regulatory requirements.

• Experience with data classification standards and the ability to translate policies into technical controls.

• Familiarity with security frameworks such as NIST, ISO 27001, or SOC 2.

• Understanding of relevant regulatory requirements such as GDPR, CCPA, or HIPAA.

• Google Workspace experience in the areas of responsibility for at least 1 year.

• Exposure to SSPM tooling and CIS hardening standards for SaaS and endpoint environments.

• Proficiency with SIEM such as Google SecOps for security operations and investigation workflows.

• Familiarity with email security gateway solutions for threat prevention, filtering, and analysis.

• Hands-on experience with Okta for identity and access management in a security context.

• Experience with YARA rules or similar pattern-matching detection methods.

• Excellent analytical and problem-solving abilities.

• Ability to work effectively under pressure.

• Capable of handling multiple incidents simultaneously.

• Strong communication and interpersonal skills to collaborate with various teams.

• Bachelor's degree in Computer Science, Information Security, or a related field. Equivalent work experience will be considered.

• Experience with frameworks such as ISO 27001, SOC 2, and PCI-DSS.

• Responsible for defining and implementing key security controls. 

• Practical incident response experience including triage, investigation, containment, and communications.

• Identifying, prioritizing, and automating remediation of security vulnerabilities.

• Experience conducting vendor and third-party security assessments, including evaluating risk posture, reviewing security questionnaires, and ensuring third parties meet organizational security standards.

👉 Optional extras that would help a candidate stand out (keep this short).

• CompTIA Security+, CySA+, CCSP or equivalent certifications are a plus.

• GCIH, GCFA are a plus.