Senior Security Engineer - xStocks

Join a globally distributed engineering team building secure infrastructure for tokenized real-world assets and blockchain-based financial products. In this role, you will combine hands-on software engineering with offensive security, helping protect systems that manage valuable digital assets across multiple blockchain networks. You will take ownership of security initiatives from threat modeling and penetration testing to smart contract audits and incident response. Working closely with engineering, security leadership, and compliance teams, you will strengthen platform resilience while ensuring security remains central to product development. You will also contribute directly to production code, balancing security improvements with ongoing product delivery. This is an opportunity to shape security practices in a fast-evolving environment where technical excellence, sound risk judgment, and proactive ownership are essential.

• Software engineering expertise: Strong experience writing, reviewing, and maintaining production code, particularly with TypeScript and Node.js, and the ability to understand complex systems and identify potential weaknesses.

• Application and infrastructure security: Solid understanding of common application vulnerabilities and secure design principles, including OWASP-related risks, authentication and authorization, injection attacks, server-side request forgery (SSRF), and software supply-chain threats.

• Offensive security experience: Demonstrated practical experience in penetration testing, vulnerability research, red-team activities, or comparable offensive security work.

• Cryptography and blockchain security: Knowledge of symmetric and asymmetric cryptography, hashing, digital signatures, and key management, together with an understanding of the security models of EVM-compatible networks and Solana. Familiarity with TON or Tron is an advantage.

• Smart contract analysis: Ability to read and assess smart contract code, identify potential vulnerabilities, and reason about how implementation flaws or protocol interactions could affect security.

• End-to-end ownership: Proven ability to take ambiguous security challenges, audits, incidents, or due diligence requests and drive them through investigation, remediation, and closure with minimal supervision.

• Secure systems design: Experience evaluating distributed systems, access controls, transaction workflows, and integrations with external providers, with a strong understanding of practical security trade-offs.

• Communication and collaboration: Ability to explain technical risks clearly to engineers, security executives, auditors, and compliance stakeholders, adapting recommendations to different audiences.

• Automation mindset: A proactive approach to eliminating recurring security issues through tooling, testing, monitoring, documentation, and sustainable engineering improvements.

• Risk assessment and prioritization: Strong judgment in evaluating vulnerability severity, likelihood, business impact, and remediation options to focus resources on the most material risks.

• Additional advantageous experience: Familiarity with third-party smart contract audits, custody and signing infrastructure, MPC and HSM technologies, cloud security in AWS or GCP, IAM, container hardening, runtime security, SIEM, and security observability. Relevant certifications such as OSCP, OSWE, or GWAPT, as well as experience in regulated fintech, tokenization, or decentralized finance, are beneficial.