Product Security Engineer

Role overview Secure a portfolio of financial and blockchain products through hands-on testing, threat analysis, and close work with engineering teams. The role focuses on finding and helping fix real weaknesses across applications, APIs, infrastructure, and on-chain trading flows. You’ll help shape product security practices in a fast-moving environment, with direct responsibility for following findings from discovery through remediation.

Responsibilities - Test applications, APIs, and infrastructure using manual assessments and realistic attack scenarios; work with engineers to address verified issues. - Threat-model new services and features, examining attack surfaces and adversary behavior in trading, order-book, and transaction flows. - Triage vulnerabilities, assess severity, write actionable remediation guidance, and verify fixes. - Reproduce and assess vulnerability reports from external researchers, and communicate findings and outcomes clearly. - Review risks from AI tools used by engineering teams, including prompt injection and data exposure, and help maintain security baselines.

Requirements - At least five years of hands-on application, product, or penetration-testing security experience. - Demonstrated success finding vulnerabilities through testing, architecture or code review, or attack simulation, with specific examples of findings and methods. - Practical security experience with exchanges or trading platforms, ideally decentralized finance; familiarity with order books, transaction flows, wallet security, and trading infrastructure threats. - Ability to script and automate security work across a technology stack. - Experience assessing and triaging vulnerabilities and giving developers clear, actionable fixes. - Strong written English for technical tickets, assessment reports, and researcher communications.

Nice to have - Cloud or container security experience, including access controls, network policies, secrets, image scanning, or hardening. - Ability to review code in TypeScript or JavaScript, Solidity, or Rust; knowledge of software supply-chain risks or bug bounty programs. - Experience securing AI or large-language-model tools. Japanese language ability may also be useful.

Benefits and work setup - Tokyo or Singapore is preferred. Remote candidates may be considered if they can overlap at least three hours with Tokyo business hours.