What you'll be doing

• Own security deliverables end to end including coordinating and reviewing smart-contract audits, responding to security questionnaires and due-diligence requests, supporting CISO and compliance initiatives, and managing remediation of findings.
• Conduct offensive security assessments such as pentesting web apps, APIs, backend services, and on-chain components, and develop tools for repeated testing.
• Continuously assess security posture by threat modeling new and existing systems, reviewing architecture and key-management flows, and maintaining risk mitigations.
• Review code changes impacting authentication, cryptography, custody, signing, and fund movement across multiple blockchains.
• Harden the platform by improving secrets handling, IAM policies, dependency and supply-chain hygiene, and enhancing detection/logging for security events.
• Secure custody and signing workflows, including transaction signing flows, MPC and HSM integrations, and access control policies.
• Contribute to product engineering with TypeScript backlog work to stay close to the codebase being defended.
• Support incident management activities such as detection, triage, response, post-mortem analysis, and implementing lessons learned.

Requirements

• An engineer first with the ability to write and review production code comfortably (TypeScript and Node.js) and deep understanding of system weaknesses.
• Strong fundamentals in application and infrastructure security including OWASP vulnerabilities, authentication, authorization, injections, SSRF, supply-chain risks, and secure design; experience in pentesting, vulnerability research, or red teaming.
• Applied cryptography and blockchain security knowledge covering symmetric and asymmetric primitives, hashing, signatures, key management, and security models of EVM, Solana, and ideally TON or Tron smart contracts.
• Ownership and ability to independently manage ambiguous security tasks like audits, questionnaires, or incidents through to completion.
• Clear communication skills to explain risks tailored to engineers, CISOs, and auditors.
• Strong automation mindset to convert manual findings into tests, alerts, controls, documentation, or platform improvements.
• Good risk judgment to differentiate theoretical from material issues and communicate severity, likelihood, impact, and remediation trade-offs clearly.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and on-chain transaction security.
• Cloud security expertise in GCP or AWS, including IAM and container/runtime hardening.
• Experience with detection engineering and security observability tools such as SIEM and log-based detections.
• Relevant professional certifications like OSCP, OSWE, or GWAPT.
• Prior work in regulated fintech or tokenization/DeFi environments.

Perks and benefits

• Work at a cutting-edge company building modern global financial infrastructure advancing open finance.
• Be part of a diverse, global, and inclusive team that values unique perspectives and talents.
• Opportunity to work cross-functionally with engineering, security, compliance, and leadership.
• Environment encouraging merit-based hiring and consideration of candidates with varied backgrounds including those with passions for crypto.
• Commitment to equal opportunity employment and a discrimination-free workplace.