Senior Security Engineer

About the role

Join the xStocks team within Payward to lead security for a platform that tokenizes real‑world assets across multiple blockchains. You will work side‑by‑side with engineers, own end‑to‑end security deliverables, and contribute to product development.

Key responsibilities

• Own security deliverables end‑to‑end, including smart‑contract audit coordination, questionnaire responses, and compliance support.
• Conduct offensive assessments: pentest web apps, APIs, backend services, and on‑chain components, and build reusable tooling.
• Continuously assess security posture through threat modeling, architecture reviews, and key‑management flow analysis.
• Review code changes affecting authentication, cryptography, custody, signing, and fund movement.
• Harden the platform by improving secrets handling, IAM, supply‑chain hygiene, and security event logging.
• Secure custody and signing workflows, including MPC, HSM integrations, signer permissions, and break‑glass procedures.
• Contribute to product engineering by handling regular TypeScript backlog items and supporting incident detection, triage, and post‑mortems.

Required profile

• Strong engineering background with production‑grade TypeScript and Node.js experience.
• Deep knowledge of application and infrastructure security fundamentals (OWASP, authn/authz, injection, SSRF, supply‑chain risk).
• Hands‑on offensive security experience such as pentesting, vulnerability research, or red‑team work.
• Applied cryptography and blockchain security expertise, including EVM, Solana, and preferably TON or Tron.
• Proven ability to drive ambiguous security tasks to closure with clear communication to engineers, CISO, and auditors.
• Automation mindset: turn recurring findings into tests, alerts, or platform improvements.

Required skills

• TypeScript, Node.js
• OWASP vulnerability categories, authentication/authorization, injection, SSRF
• Cryptography primitives, hashing, signatures, key management
• Smart‑contract analysis for EVM, Solana, TON, Tron
• MPC, HSM integration experience
• Cloud security (GCP or AWS), IAM, container hardening