← All roles

Senior Security Engineer - xStocks

Kraken· Engineering
Apply on company site
RemoteFull-timePosted 5d ago

About the role

Senior Security Engineer focusing on security for xStocks, a Payward project that brings real-world assets on-chain. Hybrid engineering and security role responsible for end-to-end security deliverables, offensive assessments, posture maintenance, code reviews for security, and incident support within a remote, globally distributed team.

Responsibilities

  • Own security deliverables end to end. Coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes.
  • Run offensive assessments against our own platforms. Pentest the web apps, APIs, backend services, and on-chain components, and build the tooling to do it repeatedly rather than once.
  • Continuously assess posture. Threat-model new and existing systems, review architecture and key-management flows, and maintain a living view of the risks and their mitigations.
  • Review code for security. Be a default reviewer on changes touching auth, cryptography, custody, signing, and fund movement across our chains.
  • Harden the platform. Improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
  • Secure custody and signing workflows. Review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
  • Contribute to product engineering. Pick up regular backlog work in TypeScript so you stay close to the codebase you are defending.
  • Support incidents. Help with detection, triage, response, and post-mortems, and feed the lessons back into the program.

Qualifications

  • An engineer first. You write and review production code comfortably, TypeScript and Node.js in our stack, and you understand systems deeply enough to break them.
  • Strong application and infrastructure security fundamentals. The OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design. You have done real offensive work in pentesting, vuln research, or red-team.
  • Applied cryptography and blockchain security. Symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron. You can read a smart contract and reason about how it fails.
  • Ownership. You can take an ambiguous security item, an audit, a questionnaire, or an incident, and drive it to closure without being managed through it.
  • Clear communication. You can explain a risk to engineers, to a CISO, and to an auditor, and tailor the message to each.
  • An automation instinct. You do not want to catch the same issue manually twice, so you turn findings into tests, alerts, controls, documentation, or platform improvements.
  • Risk judgment. You can tell a theoretical issue from a material one, and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

Skills

Required:TypeScriptNode.jsOffensive security / pentestingCryptography & blockchain security

Benefits

  • *Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis.*
  • Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution.
  • We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance.
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Kraken

setter-30setter-30-2026-q1
Company profileWebsite

More open roles at Kraken