Kraken

Senior Security Engineer - xStocks

Brak informacji o wynagrodzeniu

SeniorZdalnieFull-time

#460742·Dodano 10 dni temu·4

Źródło: Kraken

Aplikuj teraz

Tech Stack / Keywords

TypeScript Node.jsEVMSolanaHSMMPCIAMAWS GCP SIEM

Podsumowanie oferty

The xStocks team builds infrastructure for issuing, custodying, and settling regulated tokenized securities across multiple blockchains. You will own security work end to end, including offensive assessments, security reviews, and incident support, while contributing to product engineering in TypeScript.

Wymagania

Write and review production code, including TypeScript and Node.js, and understand systems deeply enough to assess how they can be broken.
Have strong application and infrastructure security fundamentals, including the OWASP vulnerability landscape, authentication and authorization, injection, SSRF, supply-chain risk, and secure design.
Have performed offensive security work in pentesting, vulnerability research, or red teaming.
Understand applied cryptography and blockchain security, including symmetric and asymmetric primitives, hashing, signatures, key management, and the security models of EVM and Solana; ideally, also TON or Tron.
Be able to read a smart contract and reason about how it can fail.
Drive ambiguous security items, audits, questionnaires, or incidents through to completion.
Explain risks to engineers, a CISO, and an auditor, adapting the message to each audience.
Turn findings into tests, alerts, controls, documentation, or platform improvements.
Assess severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have:

Experience commissioning or remediating third-party smart-contract audits.
Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
Cloud security experience with GCP or AWS, IAM, and container and runtime hardening.
Detection engineering and security observability experience, including SIEM and log-based detections.
Certifications such as OSCP, OSWE, or GWAPT.
Previous work in a regulated fintech or tokenization/DeFi environment.

Obowiązki

Own security deliverables end to end, including coordinating and reviewing smart-contract audits, responding to security questionnaires and due-diligence requests, supporting CISO and compliance initiatives, and tracking findings through remediation.
Pentest web apps, APIs, backend services, and on-chain components, and build tooling for repeatable assessments.
Threat-model systems, review architecture and key-management flows, and maintain a view of risks and mitigations.
Review code changes involving authentication, cryptography, custody, signing, and fund movement across the team’s chains.
Improve secrets handling, IAM and least privilege, dependency and supply-chain hygiene, and security-event detection and logging.
Review and harden transaction-signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
Complete regular backlog work in TypeScript.
Support incident detection, triage, response, and post-mortems, and feed lessons back into the security program.

Inne informacje

Candidates may be asked to complete job-related skills or work-style assessments as part of the hiring process.

Kraken

24 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz