Open security roles at PayPal, and what we know about the team behind them.
information technology & services · 25000 employees · 5 open roles. Updated October 15, 2026.
PayPal
“* **Stated AppSec Mission:** PayPal emphasizes creating strong, secure payment systems and integrating security into...”
PayPal
“* **Stated AppSec Mission:** PayPal emphasizes creating strong, secure payment systems and integrating security into...”
PayPal
“* **Stated AppSec Mission:** PayPal emphasizes creating strong, secure payment systems and integrating security into...”
PayPal
“* **Stated AppSec Mission:** PayPal emphasizes creating strong, secure payment systems and integrating security into...”
PayPal
“* **Stated AppSec Mission:** PayPal emphasizes creating strong, secure payment systems and integrating security into...”
Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.
How they approach application security
The team
* **Org Structure & Reporting Line:** The "Threat Exposure Management team, is part of Product Security, and helps to drive PayPal's vulnerability management program."– Application Security Engineer Job Posting (https://www.tealhq.com/job/application-security-engineer_d4ea0c62-0cd3-4e9c-a719-fd441a24eb4a), Job Posting * **Key Public-Facing Leaders:** * **David Messerschmidt, Product Security @ PayPal** – LinkedIn Profile (https://www.linkedin.com/in/davidmess) * Key Quote: "David oversees the Application Security program for PayPal business units."– David Messerschmidt LinkedIn Profile (https://www.linkedin.com/in/davidmess), LinkedIn Profile * **Hao Wang, Director Offensive Security @ PayPal** – LinkedIn Profile (https://www.linkedin.com/in/haowang86) * Key Quote: "Hao currently leads Offensive Security at PayPal."– Hao Wang LinkedIn Profile (https://www.linkedin. * **Active AppSec Job Postings (as_of:):** * **Count:** At least 1 (Application Security Engineer, Sr Staff Product Security Engineer). * **Common Skill/Tool Patterns:** SAST, SCA, Secrets, vulnerability management, API security testing, mobile app security testing. "You will focus on vulnerability identification methods, such as, but not limited to Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Secrets."– Application Security Engineer Job Posting (https://www.tealhq.com/job/application-security-engineer_d4ea0c62-0cd3-4e9c-a719-fd441a24eb4a), Job Posting
What they're working on
* **"Shift Left"in Practice:** PayPal uses SAST to analyze code early in the development process. "Analyzes code early in the development process, without executing the application."– Inside PayPal's Security Testing (https://www.frugaltesting.com/blog/inside-paypals-security-testing-how-your-digital-wallet-stays-safe), Blog Post * **Vulnerability Management Process:** * **Intake:** PayPal has a Bug Bounty Program. "PayPal has partnered with HackerOne to engage the security research community."– PayPal Secure Technology (https://www.paypal.com/us/security/learn-about-paypal-secure-technology), Official Documentation * **Triage/Remediation:** There must be a vulnerability management process. "Vulnerabilities should be categorized by criticality, and the relevant patches applied based on that criticality designation."– Security guidelines and best practices (https://developer.paypal.com/reference/guidelines/info-security-guidelines/), Official Documentation * **Secure SDLC Artifacts:** PayPal conducts API security testing, mobile app security testing, and regression testing. "PayPal uses a variety of api security testing tools to make sure APIs are resistant."– Inside PayPal's Security Testing (https://www.frugaltesting.com/blog/inside-paypals-security-testing-how-your-digital-wallet-stays-safe), Blog Post * **Recent Initiatives (Last 6 Months):** PayPal security researchers (Hao Wang, Caleb Sargent, Harrison Pomeroy) plan to disclose novel email spoofing attack patterns at Black Hat USA. – 20 Million Trusted Domains Vulnerable to Email Hosting Exploits (https://www.darkreading.com/threat-intelligence/20-million-trusted-domains-vulnerable-to-email-hosting-exploits), News Article ⚠️ staleness flag