Senior Security Engineer - xStocks

The role

This is a hybrid engineering and security role for the xStocks team. You will own security deliverables, run offensive assessments, and contribute to product engineering using TypeScript.

What you will do

• Own security deliverables end to end.
• Coordinate and review smart-contract audits.
• Respond to security questionnaires and due-diligence requests.
• Support CISO and compliance initiatives.
• Run offensive assessments against platforms including web apps, APIs, backend services, and on-chain components.
• Threat-model new and existing systems.
• Review code for security in auth, cryptography, custody, signing, and fund movement.
• Harden the platform through improved secrets handling, IAM, and supply-chain hygiene.
• Secure custody and signing workflows.
• Contribute to product engineering backlog work in TypeScript.

Required qualifications

• Write and review production code in TypeScript and Node.js.
• Strong application and infrastructure security fundamentals including OWASP-class vulnerabilities, authn, authz, injection, SSRF, and supply-chain risk.
• Experience in offensive work such as pentesting, vuln research, or red-team.
• Applied cryptography and blockchain security including symmetric and asymmetric primitives, hashing, signatures, and key management.
• Knowledge of the security model of EVM and Solana.
• Ability to read a smart contract and reason about how it fails.
• Ability to drive ambiguous security items, audits, questionnaires, or incidents to closure.
• Clear communication to engineers, CISOs, and auditors.
• Automation instinct to turn findings into tests, alerts, or controls.
• Risk judgment to communicate severity, likelihood, impact, and remediation tradeoffs.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers.
• Cloud security depth in GCP or AWS, IAM, and container and runtime hardening.
• Detection engineering and security observability, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech or tokenization/DeFi environment.

Before you apply

• Applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance or graduation.
• We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process.

About the company

Payward is the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks. It builds financial infrastructure platforms to advance an open, global financial system.