Senior Security Engineer - xStocks

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security Engineer – xStocks based in Brazil . Join a globally distributed engineering team building secure infrastructure for tokenized real-world assets and blockchain-based financial products. In this role, you will combine hands-on software engineering with offensive security, helping protect systems that manage valuable digital assets across multiple blockchain networks. You will take ownership of security initiatives from threat modeling and penetration testing to smart contract audits and incident response. Working closely with engineering, security leadership, and compliance teams, you will strengthen platform resilience while ensuring security remains central to product development. You will also contribute directly to production code, balancing security improvements with ongoing product delivery. This is an opportunity to shape security practices in a fast-evolving environment where technical excellence, sound risk judgment, and proactive ownership are essential.

Lead security initiatives: Own security deliverables from assessment through remediation, including coordinating smart contract audits, responding to security questionnaires, supporting due diligence, and collaborating with security leadership and compliance teams. Conduct offensive security assessments: Perform penetration testing across web applications, APIs, backend services, and blockchain components. Develop repeatable tools and processes to identify vulnerabilities continuously. Manage security risks: Conduct threat modeling for new and existing systems, review architecture and key-management processes, and maintain clear documentation of identified risks, mitigation strategies, and remediation progress. Review code and architecture: Act as a security-focused reviewer for changes involving authentication, authorization, cryptography, custody, transaction signing, and the movement of funds across supported blockchain networks. Strengthen platform security: Improve secrets management, identity and access management, least-privilege controls, dependency security, software supply-chain protection, monitoring, and security event logging. Secure custody and transaction signing: Assess and harden signing workflows, multi-party computation (MPC) and hardware security module (HSM) integrations, signer permissions, administrative access, approval policies, and emergency access procedures. Contribute to product engineering: Work directly with the engineering team on regular TypeScript development tasks, maintaining practical knowledge of the production codebase and its security requirements. Support security incident management: Participate in threat detection, incident triage, response, and post-incident reviews, translating lessons learned into lasting improvements to security controls and engineering practices. Automate security processes: Turn recurring findings into automated tests, monitoring alerts, preventive controls, documentation, and platform improvements that reduce manual effort and prevent repeat vulnerabilities. Requirements Software engineering expertise: Strong experience writing, reviewing, and maintaining production code, particularly with TypeScript and Node.js, and the ability to understand complex systems and identify potential weaknesses. Application and infrastructure security: Solid understanding of common application vulnerabilities and secure design principles, including OWASP-related risks, authentication and authorization, injection attacks, server-side request forgery (SSRF), and software supply-chain threats. Offensive security experience: Demonstrated practical experience in penetration testing, vulnerability research, red-team activities, or comparable offensive security work. Cryptography and blockchain security: Knowledge of symmetric and asymmetric cryptography, hashing, digital signatures, and key management, together with an understanding of the security models of EVM-compatible networks and Solana. Familiarity with TON or Tron is an advantage. Smart contract analysis: Ability to read and assess smart contract code, identify potential vulnerabilities, and reason about how implementation flaws or protocol interactions could affect security. End-to-end ownership: Proven ability to take ambiguous security challenges, audits, incidents, or due diligence requests and drive them through investigation, remediation, and closure with minimal supervision. Secure systems design: Experience evaluating distributed systems, access controls, transaction workflows, and integrations with external providers, with a strong understanding of practical security trade-offs. Communication and collaboration: Ability to explain technical risks clearly to engineers, security executives, auditors, and compliance stakeholders, adapting recommendations to different audiences. Automation mindset: A proactive approach to eliminating recurring security issues through tooling, testing, monitoring, documentation, and sustainable engineering improvements. Risk assessment and prioritization: Strong judgment in evaluating vulnerability severity, likelihood, business impact, and remediation options to focus resources on the most material risks. Additional advantageous experience: Familiarity with third-party smart contract audits, custody and signing infrastructure, MPC and HSM technologies, cloud security in AWS or GCP, IAM, container hardening, runtime security, SIEM, and security observability. Relevant certifications such as OSCP, OSWE, or GWAPT, as well as experience in regulated fintech, tokenization, or decentralized finance, are beneficial. Benefits Remote work: Opportunity to work remotely from Brazil within a globally distributed organization. Full-time employment: A full-time role offering the opportunity to contribute to critical financial technology infrastructure. Technical ownership: Lead security initiatives and influence architectural decisions across blockchain, application, and infrastructure security. Cross-functional collaboration: Work closely with engineering teams, security leadership, and compliance professionals on high-impact initiatives. Professional growth: Expand your expertise in blockchain security, cryptography, smart contract assessments, custody infrastructure, and offensive security. Modern engineering environment: Contribute to production software while developing repeatable security tooling, automation, and engineering standards. Meaningful impact: Help protect tokenized financial assets and strengthen the reliability and security of products operating across multiple blockchain networks.