Senior Security Engineer - xStocks

• Write and review production code, including TypeScript and Node.js, and understand systems deeply enough to assess how they can be broken.
• Have strong application and infrastructure security fundamentals, including the OWASP vulnerability landscape, authentication and authorization, injection, SSRF, supply-chain risk, and secure design.
• Have performed offensive security work in pentesting, vulnerability research, or red teaming.
• Understand applied cryptography and blockchain security, including symmetric and asymmetric primitives, hashing, signatures, key management, and the security models of EVM and Solana; ideally, also TON or Tron.
• Be able to read a smart contract and reason about how it can fail.
• Drive ambiguous security items, audits, questionnaires, or incidents through to completion.
• Explain risks to engineers, a CISO, and an auditor, adapting the message to each audience.
• Turn findings into tests, alerts, controls, documentation, or platform improvements.
• Assess severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have:

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
• Cloud security experience with GCP or AWS, IAM, and container and runtime hardening.
• Detection engineering and security observability experience, including SIEM and log-based detections.
• Certifications such as OSCP, OSWE, or GWAPT.
• Previous work in a regulated fintech or tokenization/DeFi environment.

• Own security deliverables end to end, including coordinating and reviewing smart-contract audits, responding to security questionnaires and due-diligence requests, supporting CISO and compliance initiatives, and tracking findings through remediation.
• Pentest web apps, APIs, backend services, and on-chain components, and build tooling for repeatable assessments.
• Threat-model systems, review architecture and key-management flows, and maintain a view of risks and mitigations.
• Review code changes involving authentication, cryptography, custody, signing, and fund movement across the team’s chains.
• Improve secrets handling, IAM and least privilege, dependency and supply-chain hygiene, and security-event detection and logging.
• Review and harden transaction-signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Complete regular backlog work in TypeScript.
• Support incident detection, triage, response, and post-mortems, and feed lessons back into the security program.

• Candidates may be asked to complete job-related skills or work-style assessments as part of the hiring process.