Senior Security Engineer

This is a fully remote position, open to applicants in Poland.

📋 Description

• Oversee and evaluate audits of smart contracts.

• Address security questionnaires and fulfill due diligence requests.

• Assist the Chief Information Security Officer (CISO) and support compliance efforts.

• Monitor findings until successful remediation is achieved.

• Perform penetration testing on web applications, APIs, backend services, and on-chain components.

• Develop reusable security assessment tools.

• Conduct threat modeling for both new and existing systems.

• Assess architecture and key management processes.

• Keep an updated view of risks and their mitigations.

• Analyze code related to authentication, cryptography, custody, signing, and fund transfers across blockchains.

• Enhance the management of secrets, Identity and Access Management (IAM), least privilege, dependency and supply chain security, detection, and logging.

• Secure custody and signing processes, including Multi-Party Computation (MPC)/Hardware Security Module (HSM) integrations, signer permissions, administrative roles, approval protocols, and break-glass procedures.

• Contribute to TypeScript product-engineering tasks.

• Assist with security detection, triage, incident response, and post-incident reviews.

• Collaborate with Payward security, CISO, and compliance teams.

• Report directly to the engineering department.

⛳️ Requirements

• Experience in production code development and review, particularly with TypeScript and Node.js.

• Strong foundation in application and infrastructure security, including knowledge of OWASP-class vulnerabilities, authentication and authorization, injection attacks, Server-Side Request Forgery (SSRF), supply chain risks, and secure design principles.

• Practical experience in offensive security, including penetration testing, vulnerability research, or red teaming.

• Knowledge of applied cryptography, including symmetric and asymmetric algorithms, hashing, signatures, and key management practices.

• Understanding of blockchain security across Ethereum Virtual Machine (EVM) and Solana; familiarity with TON or Tron is ideal.

• Capability to read smart contracts and analyze potential failure modes.

• Ability to independently manage ambiguous security tasks, including audits, questionnaires, or incident resolution.

• Proficient in communicating risks to engineers, a CISO, and auditors.

• Automation-focused approach to transforming findings into tests, alerts, controls, documentation, or enhancements to the platform.

• Competence in evaluating severity, likelihood, impact, and remediation trade-offs.

• Familiarity with custody and signing infrastructure like HSMs, MPC, and ForDefi-style providers (preferred).

• Experience in cloud security, particularly in GCP or AWS, IAM, and hardening containers/runtimes (preferred).

• Knowledge of detection engineering and security observability, including SIEM and log-based detections (preferred).

• Possession of OSCP, OSWE, or GWAPT certification (preferred).

• Previous experience in regulated fintech or tokenization/DeFi (preferred).

• Ability to work from an eligible country/location and fulfill work sponsorship requirements.

🏝️ Benefits

• Opportunity to be part of Payward, the parent organization behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services, and CF Benchmarks.

• Flexible remote work arrangement.

• Collaborate with global teams and a diverse range of colleagues.

• Applications are accepted continuously unless a specific deadline is specified.

• Commitment to equal opportunity employment.

• Job-related skills or work-style assessments will be considered alongside experience and interviews.

• Participate in Kraken product testing after joining.