Senior Security Engineer/Architect

About the Role

We’re looking for a hands-on Security Engineer / Architect to help secure our systems, data, and funds across our infrastructure.

You’ll work closely with IT, Infra, R&D, Web3, Product, and business teams to design practical security controls, lead security projects end-to-end, run offensive security exercises, and support ongoing security initiatives. This is a role for someone who is comfortable going from high-level architecture to very concrete implementation details and automation.

Responsibilities

Core Security Engineering

• Design and implement security controls to protect sensitive data, financial assets, and critical systems, ensuring integrity, confidentiality, and availability.
• Evaluate, recommend, and lead the implementation of security solutions (tools, platforms, processes) in a hands-on manner.
• Own security projects from inception to rollout, working closely with IT, Infrastructure, R&D, Web3 and other business units to ensure secure and timely delivery.
• Proactively identify and assess risks and vulnerabilities, and define/enforce mitigation strategies (technical and process).

Offensive Security, Testing & Bug Bounty

• Plan and execute penetration tests and targeted assessments (applications, APIs, infrastructure) either directly or by coordinating external partners.
• Lead or support red teaming / adversarial simulations to test detection, response, and real-world resiliency of critical workflows and infrastructure.
• Work with engineering teams on purple teaming style exercises: jointly validating detections, hardening controls, and improving runbooks.
• Own the technical side of the bug bounty / responsible disclosure process:
• Triage and validate incoming reports
• Coordinate with engineering owners
• Track remediation and communicate outcomes internally (and externally where needed)

Automation & Security Engineering

• Build and maintain security automation: scripts, playbooks, and pipelines that reduce manual toil (e.g., auto-enrichment of alerts, automated checks in CI/CD, policy-as-code).
• Integrate and tune SAST/DAST/SCA, IaC scanning, image scanning, and secrets scanning into CI/CD to catch issues early with minimal noise.
• Implement detection-as-code (e.g., for SIEM / logging platforms) and continuously refine alerts based on real incidents and red team learnings.

Policy, Operations & Collaboration

• Develop, refine, and maintain security policies, standards, and procedures, with a strong focus on data, funds, and access security.
• Contribute to day-to-day security operations and monitoring, including reviewing alerts, supporting incident response, and improving detection & response capabilities.
• Collaborate with stakeholders (IT, HR, Infra, R&D, Product, Trading, and other teams) to align security initiatives with business goals and product roadmaps.

Background & Experience

• 5+ years of hands-on experience in cybersecurity, with a proven track record designing and implementing security solutions, frameworks, and policies.
• Experience with security architecture, risk assessments, and vulnerability management in complex, fast-paced environments.
• Demonstrated experience in at least one of:

----- Penetration testing / offensive security (infra, apps, APIs, or Web3), or

----- Running or working closely with red team / purple team engagements

• Experience triaging and managing security findings from scanners, pen tests, and bug bounty programs (HackerOne, Bugcrowd, self-hosted, etc.).
• Demonstrated ability to deploy and administer IAM platforms (e.g., Okta or similar) and define robust access models (RBAC, SSO, MFA).
• Competence in configuring and managing EDR and MDM solutions across a diverse device and user base.
• Hands-on experience with regulatory and compliance requirements relevant to financial institutions or crypto companies (e.g., SOC 2, ISO 27001:2022, DORA, NIST, CIS).
• Interest in Web3 / crypto (DeFi, trading platforms, digital asset custody/security, etc.) is highly advantageous
• Comfort with at least one scripting / programming language (Python, Go, TypeScript, etc.) to build automations, integrations, and internal tools.

Competencies & Personality

• Strong team player who enjoys working cross-functionally with IT, HR, Infra, R&D, Product, Trading, and business stakeholders.
• Genuinely passionate about cybersecurity, offensive and defensive — enjoys thinking like an attacker but building like an engineer.
• Experience embedding security best practices into day-to-day workflows (development, infrastructure, operations) and driving automation over manual checks.
• Ability to articulate complex security concepts in clear, practical terms to both technical and non-technical audiences.
• Values ownership, accountability, and clear communication, and is comfortable operating in a fast-changing environment with high autonomy.
  

Certifications

Must-have

• OSCP – we expect a deep, hands-on understanding of offensive techniques, not just theory.

Nice to have

• CISSP, CISM, or equivalent broad security leadership/architecture certifications.
• Relevant GIAC certs (e.g., GWAPT, GCPN, GSEC, GCLD, GCIA, GIAC Cloud / Web / Exploit tracks).
• Cloud security certifications (e.g., AWS Security Specialty, Azure Security Engineer, GCP Professional Cloud Security Engineer).
• Kubernetes / container security or general K8s certifications (CKS, CKA, etc.).