Senior Security Engineer - xStocks

Job description

**This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security Engineer – xStocks based in Brazil.** Join a globally distributed engineering team building secure infrastructure for tokenized real-world assets and blockchain-based financial products. In this role, you will combine hands-on software engineering with offensive security, helping protect systems that manage valuable digital assets across multiple blockchain networks. You will take ownership of security initiatives from threat modeling and penetration testing to smart contract audits and incident response. Working closely with engineering, security leadership, and compliance teams, you will strengthen platform resilience while ensuring security remains central to product development. You will also contribute directly to production code, balancing security improvements with ongoing product delivery. This is an opportunity to shape security practices in a fast-evolving environment where technical excellence, sound risk judgment, and proactive ownership are essential. ### Accountabilities - Lead security initiatives: Own security deliverables from assessment through remediation, including coordinating smart contract audits, responding to security questionnaires, supporting due diligence, and collaborating with security leadership and compliance teams. - Conduct offensive security assessments: Perform penetration testing across web applications, APIs, backend services, and blockchain components. Develop repeatable tools and processes to identify vulnerabilities continuously. - Manage security risks: Conduct threat modeling for new and existing systems, review architecture and key-management processes, and maintain clear documentation of identified risks, mitigation strategies, and remediation progress. - Review code and architecture: Act as a security-focused reviewer for changes involving authentication, authorization, cryptography, custody, transaction signing, and the movement of funds across supported blockchain networks. - Strengthen platform security: Improve secrets management, identity and access management, least-privilege controls, dependency security, software supply-chain protection, monitoring, and security event logging. - Secure custody and transaction signing: Assess and harden signing workflows, multi-party computation (MPC) and hardware security module (HSM) integrations, signer permissions, administrative access, approval policies, and emergency access procedures. - Contribute to product engineering: Work directly with the engineering team on regular TypeScript development tasks, maintaining practical knowledge of the production codebase and its security requirements. - Support security incident management: Participate in threat detection, incident triage, response, and post-incident reviews, translating lessons learned into lasting improvements to security controls and engineering practices. - Automate security processes: Turn recurring findings into automated tests, monitoring alerts, preventive controls, documentation, and platform improvements that reduce manual effort and prevent repeat vulnerabilities. ## Requirements - Software engineering expertise: Strong experience writing, reviewing, and maintaining production code, particularly with TypeScript and Node.js, and the ability to understand complex systems and identify potential weaknesses. - Application and infrastructure security: Solid understanding of common application vulnerabilities and secure design principles, including OWASP-related risks, authentication and authorization, injection attacks, server-side request forgery (SSRF), and software supply-chain threats. - Offensive security experience: Demonstrated practical experience in penetration testing, vulnerability research, red-team activities, or comparable offensive security work. - Cryptography and blockchain security: Knowledge of symmetric and asymmetric cryptography, hashing, digital s