SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
xStocks, part of Payward (parent company of Kraken, NinjaTrader, Breakout, and CF Benchmarks), is seeking a Senior Security Engineer to join the xStocks team. xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains including EVM, Solana, TON, Tron, and more.
This is a hybrid engineering and security role designed for someone who is genuinely both engineer and security specialist. You will ship products alongside the engineering team when the security queue is quiet, and own security work end to end when it lands. You report into engineering and partner closely with Payward security, CISO, and compliance functions.
Key responsibilities include:
- Own security deliverables end to end: coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes.
- Run offensive assessments against platforms: pentest web apps, APIs, backend services, and on-chain components; build tooling to do it repeatedly.
- Continuously assess security posture: threat-model new and existing systems, review architecture and key-management flows, maintain a living view of risks and mitigations.
- Review code for security: be a default reviewer on changes touching auth, cryptography, custody, signing, and fund movement across chains.
- Harden the platform: improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, detection and logging for security-relevant events.
- Secure custody and signing workflows: review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
- Contribute to product engineering: pick up regular backlog work in TypeScript to stay close to the codebase you are defending.
- Support incidents: help with detection, triage, response, and post-mortems; feed lessons back into the program.
REQUIREMENTS:
- Engineer first: write and review production code comfortably in TypeScript and Node.js; understand systems deeply enough to break them.
- Strong application and infrastructure security fundamentals: OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design; real offensive work in pentesting, vuln research, or red-team.
- Applied cryptography and blockchain security: symmetric and asymmetric primitives, hashing, signatures, and key management; security model of EVM, Solana, and ideally TON or Tron; ability to read a smart contract and reason about how it fails.
- Ownership: take an ambiguous security item, audit, questionnaire, or incident and drive it to closure without being managed through it.
- Clear communication: explain risk to engineers, CISO, and auditors; tailor message to each audience.
- Automation instinct: turn findings into tests, alerts, controls, documentation, or platform improvements rather than catching the same issue manually twice.
- Risk judgment: tell theoretical issues from material ones; communicate severity, likelihood, impact, and remediation tradeoffs clearly.
NICE TO HAVE:
- Experience commissioning or remediating third-party smart-contract audits.
- Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
- Cloud security depth in GCP or AWS, IAM, and container and runtime hardening.
- Detection engineering and security observability, including SIEM and log-based detections.
- Relevant certifications such as OSCP, OSWE, or GWAPT.
- Prior work in a regulated fintech or tokenization/DeFi environment.
