Senior Security Engineer - xStocks
Kraken · Remote · Poland · Brazil · Peru · Sweden · Argentina · Romania · Cyprus · Czech Republic · Hungary · Mexico · Chile · Bulgaria ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Senior Security Engineer
- TypeScript + Node.js
- Blockchain security focus
- Hybrid engineering role
- Global remote team
Join the xStocks team at Payward to secure infrastructure that issues and settles tokenized real-world assets across multiple blockchains. This role blends engineering and security, requiring you to ship product features while owning security deliverables end-to-end. You will work closely with the CISO and compliance teams to protect high-value financial instruments.
What you'll do
- Own security deliverables including audit coordination and questionnaire responses
- Conduct offensive assessments on web apps, APIs, and on-chain components
- Threat-model systems and review architecture for key-management flows
- Review code changes involving auth, cryptography, and fund movement
- Harden secrets handling, IAM, and supply-chain hygiene
- Secure custody workflows including MPC and HSM integrations
- Contribute to product backlog using TypeScript
- Support incident detection, triage, and post-mortems
What you'll need
- Strong proficiency in writing and reviewing TypeScript and Node.js code
- Deep understanding of application and infrastructure security fundamentals
- Experience with OWASP vulnerabilities, authn/authz, and supply-chain risk
- Applied knowledge of cryptography and blockchain security models
- Familiarity with EVM, Solana, and ideally TON or Tron ecosystems
- Ability to drive ambiguous security items to closure independently
- Clear communication skills for engineers, auditors, and leadership
- Instinct for automating security findings into tests or controls
Nice to have
- Experience managing third-party smart-contract audits
- Familiarity with custody infrastructure like HSMs and MPC
- Cloud security depth in GCP or AWS and container hardening
- Background in detection engineering and SIEM log-based detections
- Relevant certifications such as OSCP, OSWE, or GWAPT
- Prior work in regulated fintech or DeFi environments
Stack
- TypeScript
- Node.js
- EVM
- Solana
- TON
- Tron
- HSM
- MPC
Hiring process
- Application review and potential skills assessment
- Interviews evaluating experience and competencies
- Consideration of assessment results alongside interviews