Software Quality Assurance Engineer

Role Purpose

The engineer will manage quality across the seams of our three platforms — the payment gateway, the merchant platform, and the consumer mobile app. Each engineer tests their own slice; you own the journeys that cross all of them, the objective release gate that decides what ships, the regression memory that keeps fixed bugs dead, and the audit trail that satisfies our regulators. You are the quality architect of a lean engineering team — not the person who tests everything, but the person who ensures everything is testable, tested, and evidenced.

Key Responsibilities

Cross-Surface Test Automation (~45% of time)

Own and build the end-to-end test suite covering journeys that span all three platforms — merchant onboarding, API key issuance, first transaction, webhook delivery, settlement, dashboard display, and mobile app reflection. These cross-surface seams are where payment defects actually live, and no other role tests them. Own the automated smoke suite — the 15–20 critical-path scenarios that gate every deployment across gateway, merchant platform, and mobile app. Own the regression suite — every production defect gets a regression test authored before the fix is closed. Enforce this as a non-negotiable standard. Build and maintain suites on a stack-agnostic automation platform capable of driving API, Web, and Mobile tests from a single tool. Own mobile device and OS coverage decisions — the device matrix, device-farm execution, and pre-app-store validation for the cross-platform app. Maintain the suites as first-class code — reusable page objects, API clients, and mobile flows kept clean and reviewable, contributed through merge requests like any other engineering work.

Test Environments & Test Data (~10% of time)

Own sandbox environment integrity — ensure test environments reflect production behaviour closely enough for results to be trusted. Own deterministic test data — seeding, tear-down, and isolation so that tests produce the same result every run. Own mocking of external dependencies — banks, KYC/KYB providers, sanctions-screening services — so the suite runs offline and deterministically. Diagnose and eliminate flaky tests relentlessly; a suite the team does not trust is a suite the team will bypass.

Shift-Left Quality Engagement (~15% of time)

Participate in backlog refinement as a standing attendee — convert acceptance criteria into executable test scenarios, and challenge stories that cannot be verified. Author and enforce the Definition of Ready — no story enters a sprint unless it is testable and its success conditions are explicit. Author and enforce the Definition of Done — no story leaves a sprint unless tests, documentation, and observability are in place. Set the standard for tests engineers write themselves — unit test coverage thresholds, integration test patterns, mocking conventions, and API contract test approach. You define the bar; engineers meet it in their own merge requests. Pair with engineers on testable design — nudging architecture toward seams that can be verified.

Release Verification & Quality Gating (~10% of time)

Run the release readiness checklist before every production deployment across all three platforms. Publish an objective go / no-go signal based on evidence — smoke suite status, open defect severity, regression coverage — not on optimism or schedule pressure. Coordinate the sign-off sequence with the Head of Engineering & Development and the Integration & Tech Support Lead. Define rollback criteria in advance of each release and monitor the post-release window for regression signals. Facilitate release retrospectives after each deployment; feed findings back into the process.

Exploratory & Risk-Based Testing (~10% of time)

Run exploratory testing on new features, edge cases, and adversarial scenarios — the 15–20% that automation cannot economically cover. Apply risk-based prioritisation — concentrate manual effort where money movement, regulatory exposure, or merchant trust are most at stake. Organise the rotational human smoke check across the wider team for release-day visual and device verification. Probe negative paths deliberately — duplicate submissions, malformed webhooks, expired tokens, partial failures, and network interruptions mid-transaction.

Metrics, Evidence & Reporting (~10% of time)

Track and publish quality signals on a fixed cadence: escaped defect rate, smoke suite pass rate, flaky test rate, test coverage trend, cycle time, and mean time to detect. Own the defect lifecycle governance — severity definitions, reproduction standards, triage discipline, and closure criteria. Maintain the traceability matrix — requirement to test case to test result to release — as continuous audit evidence for PCI DSS, ISO 27001, and ISO 22301, rather than a reconstruction exercise before each audit. Produce audit-ready evidence packs on request for Parent Company compliance and external assessors. Facilitate blameless post-mortems for defects that escaped to production, and convert each into a regression test and a process improvement.

Source Control and Delivery Pipeline

Our team runs on GitLab end-to-end — source control, merge requests, code review, CI/CD pipelines, and delivery tracking. Your test suites live in GitLab repositories and are contributed through merge request workflows like any other code. You will plug your automated suites into the existing CI/CD pipelines and define the quality gates those pipelines enforce, but you do not own pipeline authoring, runner configuration, or deployment mechanics — those sit with the Head of Engineering & Development and Parent Company IT. You should read .gitlab-ci.yml fluently and contribute test-job definitions. Specifics of our pipeline topology, runner configuration, and deployment targets are shared under NDA during the technical interview.

Required Qualifications & Experience

Strong foundation in software quality disciplines, including Software Quality, Quality Assurance, and Software Quality Assurance. Proficiency in Manual Testing techniques and methodologies for web, mobile, and API-based applications. Familiarity with test management and bug-tracking tools (e.g., Jira, TestRail, or equivalent). Basic knowledge of automation testing concepts and tools is an advantage. Strong analytical and problem-solving skills, with attention to detail and a focus on system reliability and user experience. Effective communication skills and ability to work collaboratively in cross-functional teams. Bachelor’s degree in Computer Science, Software Engineering, Information Technology, or a related field, or equivalent practical experience. Minimum 5+ years professional quality engineering / test automation experience, with at least 2+ years in fintech / payments or another regulated domain.

Must-Have Technical Experience

Production experience with a stack-agnostic automation platform capable of driving API, Web, and Mobile tests from a single tool (e.g., Katalon, Robot Framework, or equivalent). End-to-end test design across multiple systems — you have built suites that traverse several services and surfaces, not just one application. API testing at depth — REST contracts, authentication schemes, idempotency verification, webhook signature validation, and retry and replay semantics. Web UI automation — modern browser automation frameworks; disciplined about selector strategy and flake elimination. Mobile test automation across iOS and Android — operating a device farm (BrowserStack, Firebase Test Lab, or equivalent) and validating cross-platform app flows end-to-end. Test data management — deterministic seeding, isolation, and tear-down strategies. Mock and stub tooling for external dependencies (WireMock, Mountebank, or equivalent). SQL fluency — querying a mainstream relational database to verify transaction state, reconciliation outcomes, and data integrity after test execution. BDD / behaviour-driven scenario design — Gherkin or equivalent, in a form non-developers can read and contribute to. Defect lifecycle discipline — hands-on experience defining severity taxonomies, reproduction standards, and triage processes. Definition of Ready / Definition of Done authoring — practical experience gating stories in and out of sprints in a real team. GitLab — merge request workflows, Issues / Boards, and reading pipelines fluently.

Compliance & Confidentiality

Comfortable working under PCI/DSS, ISO 27001, and ISO 22301 control frameworks with Parent Company security and continuity oversight. You will be a primary producer of test-evidence artefacts during audits and regulatory reviews. Understands test data hygiene in a regulated environment — never uses production card data or real PII in test environments; understands tokenisation and synthetic data generation as the correct alternatives. Signs standard NDA at offer stage; understands that stack, architecture, and vendor specifics are disclosed only after signing and only on a need-to-know basis.

Behavioural Competencies

Automation-first mindset — if you tested it twice by hand, it should be scripted by the third time. Quality architect, not quality police — sets standards and builds platforms that make it easy for engineers to do the right thing, rather than blocking at the gate. Comfortable holding the line — will call a no-go on a release when evidence says so, and will articulate why without escalating into conflict. Suspicious by instinct — asks what happens if this fails halfway before asking whether the happy path works. Systems thinker — sees the seams between components as the highest-risk surface, and tests accordingly. Discretion — understands that internal architecture, merchant data, and tooling details are confidential and treats them accordingly.

How to Apply

Interested and well-qualified candidates should send their CV and application to hr@libertepay.com on or before September 30, 2026 . (Kindly indicate the tittle of the role in the subject line of the email). Only shortlisted candidates will be contacted.

<