Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will own product security across digital asset products, review application code and cryptographic workflows, model threats, assess architectures, and validate penetration-test remediation. You will build security automation for CI/CD, software supply chains, Kubernetes, and deployment platforms, while supporting access control, incident response, audits, investigations, and regulatory controls.
Requirements
- Master’s or PhD in computer science, IT security engineering, or cryptography
- 7+ years of experience in application security, product security, offensive security, or security engineering
- Experience in security-critical environments such as financial services, payments, identity, custody, embedded systems, or regulated platforms
- Fluent written and spoken English
- Strong security code review experience in at least two of Go, C, C++, TypeScript, and Python
- Experience with threat modeling, secure design reviews, and penetration testing
- Ability to identify business logic flaws, authorization issues, cryptographic misuse, and complex attack paths
- Applied cryptography knowledge including PKI, TLS, X.509, AES, RSA, ECDSA, EdDSA, key management, and signing workflows
- Experience with HSM technologies and PKCS#11 environments
- Strong Kubernetes and container security experience
- Familiarity with cloud IAM, workload identity, secrets management, and policy as code
- Experience with Thales or Luna HSM, AWS CloudHSM, Azure Managed HSM, Intel SGX, AMD SEV-SNP, AWS Nitro Enclaves, or Azure Confidential Computing
- Ability to engage security teams, auditors, regulators, enterprise clients, and prospect CISOs
- Ability to explain complex security topics clearly
- Blockchain and smart contract security experience is a plus
- MPC and threshold signature experience is a plus
- Fuzzing and secure software testing experience is a plus
- Security compliance and regulatory framework experience is a plus
- Public security research, CVEs, bug bounty, or open-source security contributions are a plus
- Experience supporting RFPs, security questionnaires, and customer due diligence is a plus
Responsibilities
- Own product security for applicable digital asset products
- Contribute to security architecture for HSMs, confidential computing, MPC, and cryptographic systems
- Review application code, cryptographic workflows, smart contracts, HSM integrations, and enclave components
- Model threats for new features
- Review architectural designs before release
- Lead and review penetration tests
- Reproduce security findings and validate remediation plans
- Build security guardrail automation across CI/CD and software supply chains
- Implement security controls for Kubernetes and deployment platforms
- Review authorization models and operational access controls
- Support incident response and vulnerability management
- Support security investigations, audits, RFPs, workshops, and regulatory discussions
- Translate compliance requirements into technical controls
- Monitor security news and apply corrective actions
Benefits
- Hybrid remote work
- Flexible working hours
- Fun team events