Kraken - Senior Security Engineer

• An engineer first. You write and review production code comfortably, TypeScript and Node.js in our stack, and you understand systems deeply enough to break them. • Strong application and infrastructure security fundamentals. The OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design. You have done real offensive work in pentesting, vuln research, or red-team. • Applied cryptography and blockchain security. Symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron. You can read a smart contract and reason about how it fails. • Ownership. You can take an ambiguous security item, an audit, a questionnaire, or an incident, and drive it to closure without being managed through it. • Clear communication. You can explain a risk to engineers, to a CISO, and to an auditor, and tailor the message to each. • An automation instinct. You do not want to catch the same issue manually twice, so you turn findings into tests, alerts, controls, documentation, or platform improvements. • Risk judgment. You can tell a theoretical issue from a material one, and communicate severity, likelihood, impact, and remediation tradeoffs clearly. • Experience commissioning or remediating third-party smart-contract audits. • Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security. • Cloud security depth in GCP or AWS, IAM, and container and runtime hardening. • Detection engineering and security observability, including SIEM and log-based detections. • Relevant certifications such as OSCP, OSWE, or GWAPT. • Prior work in a regulated fintech or tokenization/DeFi environment. • Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis. • Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution. • We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance. • Our commitment • Our commitment • Payward is powered by people from around the world and we celebrate the diverse talents, backgrounds, contributions, and unique perspectives that everyone brings to the table. We hire based on merit, seeking out people with the right abilities, knowledge, and skills for the job. We encourage you to apply for roles where you don't fully meet the listed requirements, especially if you're passionate or knowledgeable about crypto. • We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision.