Senior Security Engineer - xStocks

Your tasks

• Leadsecurityinitiatives:Ownsecuritydeliverablesfromassessmentthroughremediation,includingcoordinatingsmartcontractaudits,respondingtosecurityquestionnaires,supportingduediligence,andcollaboratingwithsecurityleadershipandcomplianceteams.
• Conductoffensivesecurityassessments:Performpenetrationtestingacrosswebapplications,APIs,backendservices,andblockchaincomponents.Developrepeatabletoolsandprocessestoidentifyvulnerabilitiescontinuously.
• Managesecurityrisks:Conductthreatmodelingfornewandexistingsystems,reviewarchitectureandkey-managementprocesses,andmaintaincleardocumentationofidentifiedrisks,mitigationstrategies,andremediationprogress.
• Reviewcodeandarchitecture:Actasasecurity-focusedreviewerforchangesinvolvingauthentication,authorization,cryptography,custody,transactionsigning,andthemovementoffundsacrosssupportedblockchainnetworks.
• Strengthenplatformsecurity:Improvesecretsmanagement,identityandaccessmanagement,least-privilegecontrols,dependencysecurity,softwaresupply-chainprotection,monitoring,andsecurityeventlogging.
• Securecustodyandtransactionsigning:Assessandhardensigningworkflows,multi-partycomputation(MPC)andhardwaresecuritymodule(HSM)integrations,signerpermissions,administrativeaccess,approvalpolicies,andemergencyaccessprocedures.
• Contributetoproductengineering:WorkdirectlywiththeengineeringteamonregularTypeScriptdevelopmenttasks,maintainingpracticalknowledgeoftheproductioncodebaseanditssecurityrequirements.
• Supportsecurityincidentmanagement:Participateinthreatdetection,incidenttriage,response,andpost-incidentreviews,translatinglessonslearnedintolastingimprovementstosecuritycontrolsandengineeringpractices.
• Automatesecurityprocesses:Turnrecurringfindingsintoautomatedtests,monitoringalerts,preventivecontrols,documentation,andplatformimprovementsthatreducemanualeffortandpreventrepeatvulnerabilities.

Requirements

• Softwareengineeringexpertise:Strongexperiencewriting,reviewing,andmaintainingproductioncode,particularlywithTypeScriptandNode.js,andtheabilitytounderstandcomplexsystemsandidentifypotentialweaknesses.
• Applicationandinfrastructuresecurity:Solidunderstandingofcommonapplicationvulnerabilitiesandsecuredesignprinciples,includingOWASP-relatedrisks,authenticationandauthorization,injectionattacks,server-siderequestforgery(SSRF),andsoftwaresupply-chainthreats.
• Offensivesecurityexperience:Demonstratedpracticalexperienceinpenetrationtesting,vulnerabilityresearch,red-teamactivities,orcomparableoffensivesecuritywork.
• Cryptographyandblockchainsecurity:Knowledgeofsymmetricandasymmetriccryptography,hashing,digitalsignatures,andkeymanagement,togetherwithanunderstandingofthesecuritymodelsofEVM-compatiblenetworksandSolana.FamiliaritywithTONorTronisanadvantage.
• Smartcontractanalysis:Abilitytoreadandassesssmartcontractcode,identifypotentialvulnerabilities,andreasonabouthowimplementationflawsorprotocolinteractionscouldaffectsecurity.
• End-to-endownership:Provenabilitytotakeambiguoussecuritychallenges,audits,incidents,orduediligencerequestsanddrivethemthroughinvestigation,remediation,andclosurewithminimalsupervision.
• Securesystemsdesign:Experienceevaluatingdistributedsystems,accesscontrols,transactionworkflows,andintegrationswithexternalproviders,withastrongunderstandingofpracticalsecuritytrade-offs.
• Communicationandcollaboration:Abilitytoexplaintechnicalrisksclearlytoengineers,securityexecutives,auditors,andcompliancestakeholders,adaptingrecommendationstodifferentaudiences.
• Automationmindset:Aproactiveapproachtoeliminatingrecurringsecurityissuesthroughtooling,testing,monitoring,documentation,andsustainableengineeringimprovements.
• Riskassessmentandprioritization:Strongjudgmentinevaluatingvulnerabilityseverity,likelihood,businessimpact,andremediationoptionstofocusresourcesonthemostmaterialrisks.
• Additionaladvantageousexperience:Familiaritywiththird-partysmartcontractaudits,custodyandsigninginfrastructure,MPCandHSMtechnologies,cloudsecurityinAWSorGCP,IAM,containerhardening,runtimesecurity,SIEM,andsecurityobservability.RelevantcertificationssuchasOSCP,OSWE,orGWAPT,aswellasexperienceinregulatedfintech,tokenization,ordecentralizedfinance,arebeneficial.

What we offer

• Remotework: Opportunity to work remotely from Brazil within a globally distributed organization.
• Full-time employment: A full-time role offering the opportunity to contribute to critical financial technology infrastructure.
• Technical ownership: Lead security initiatives and influence architectural decisions across blockchain, application, and infrastructure security.
• Cross-functional collaboration: Work closely with engineering teams, security leadership, and compliance professionals on high-impact initiatives.
• Professional growth: Expand your expertise in blockchain security, cryptography, smart contract assessments, custody infrastructure, and offensive security.
• Modern engineering environment: Contribute to production software while developing repeatable security tooling, automation, and engineering standards.
• Meaningful impact: Help protect tokenized financial assets and strengthen the reliability and security of products operating across multiple blockchain networks.

How to apply

How Jobgether works We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Other

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.