Senior Security Engineer - xStocks

Role overview Own security work for a platform that issues, holds, and settles tokenized real-world assets across several blockchain networks. This is a hands-on role embedded with product engineers: you’ll lead security reviews and assessments while also contributing production code when security priorities allow. You’ll partner with security, compliance, and executive stakeholders to turn risks and audit findings into completed improvements.

Responsibilities - Coordinate smart contract audits and handle security questionnaires and due diligence requests, tracking findings through remediation. - Test web applications, APIs, backend services, and on-chain components; build repeatable tools and processes for offensive assessments. - Threat-model systems, review architecture and key-management flows, and maintain clear records of risks and mitigations. - Review sensitive code involving authentication, cryptography, custody, signing, and movement of funds. - Improve secrets management, access controls, dependency security, runtime protections, logging, and detection. - Assess transaction signing and custody controls, including signer permissions, approval policies, and emergency procedures. - Contribute TypeScript product work, and support incident triage, response, and post-incident reviews.

Requirements - Comfortable writing and reviewing production code, especially with TypeScript and Node.js, and able to understand systems well enough to assess how they can fail. - Strong application and infrastructure security skills, including common web vulnerabilities, authentication and authorization, injection, SSRF, supply-chain risk, and secure design. - Practical offensive security experience through penetration testing, vulnerability research, or red-team work. - Applied knowledge of cryptographic primitives, signatures, hashing, and key management, plus blockchain security for EVM and Solana; ability to review smart contracts. - Able to take ambiguous security work or incidents from initial assessment through resolution with limited direction. - Clear communicator who can explain severity, likelihood, impact, and remediation tradeoffs to engineers, auditors, and security leaders. - An instinct for turning repeated findings into automated checks, controls, alerts, or lasting platform changes.

Nice to have - Experience commissioning or remediating third-party smart contract audits; familiarity with HSM or MPC custody and signing systems. - Cloud security experience with AWS or GCP, including IAM, containers, and runtime hardening. - Security monitoring or SIEM experience, relevant offensive security certifications, or work in regulated fintech, tokenization, or DeFi.