Member of Technical Staff, Security

The role

This role builds and runs security tooling, performs application security assessments and penetration tests, and manages the vulnerability lifecycle from discovery to remediation. The work covers code, cloud resources and infrastructure across the Anchorage platform, and includes coordinating incident response and supporting audit and compliance efforts.

What you will do

• Build and maintain security automation and tooling for static and dynamic analysis of code and live systems.
• Conduct application security assessments, penetration tests and code reviews.
• Develop and operate vulnerability management workflows with engineering teams.
• Establish and test security guardrails for code, cloud resources and infrastructure.
• Monitor and respond to security events and configuration anomalies, leading investigation and containment.
• Manage the full vulnerability lifecycle from discovery through remediation.
• Lead or substantially contribute to Security initiatives with minimal oversight.
• Break complex security problems into workstreams with scope and time estimates.
• Deliver assurance artifacts and evidence for regulated entity requirements.
• Share knowledge through documentation, runbooks and post-incident reviews.

Required qualifications

• 3+ years of hands-on experience in security engineering, application security, penetration testing or security.
• Experience building or maintaining security tools, integrations or automation using Python, Go or similar languages.
• Ability to identify and assess vulnerabilities in applications, APIs and cloud infrastructure.
• Experience with static and dynamic analysis tools such as Semgrep, CodeQL, Burp Suite or equivalent.
• Understanding of AWS security fundamentals including IAM, VPCs, security groups and CloudTrail/logging.
• Ability to investigate security events, perform root cause analysis and coordinate response.
• Knowledge of computer science fundamentals: concurrency, algorithms and data structures.
• Genuine care for code quality and operational excellence.
• Prioritizes security outcomes, end-user experience and business value.

Nice to have

• Experience running or participating in bug bounty programs.
• Experience in regulated financial services, fintech or crypto environments.
• Exposure to blockchain security, smart contract auditing or Web3 technologies.
• Experience building or contributing to open-source security tools.
• Relevant certifications such as OSCP, GWAPT, GCIH or AWS Security Specialty.
• Interest in blockchain protocol white papers and crypto-asset innovation.

About the company

Anchorage is the platform this role supports, with a security strategy aligned to Anchorage Digital's overall objectives. The posting describes security work across its applications, infrastructure and third-party integrations.