Senior Security Engineer, Digital Assets Platform

What you'll do

• Develop and maintain security-critical backend services in Java, including cryptographic libraries and signing workflows.
• Manage the integration and operational lifecycle of Hardware Security Modules (HSMs) for key generation and rotation.
• Architect and implement Multi-Party Computation (MPC) protocols and threshold signature schemes for distributed key management.
• Apply cryptographic best practices for symmetric/asymmetric encryption, digital signatures, and key derivation across the platform.
• Implement secure design patterns including zero-trust architecture, secrets management, and mutual TLS.
• Conduct threat modeling, security design reviews, and cryptographic risk assessments for new platform capabilities.
• Perform security-focused code reviews and embed SAST/DAST tooling into CI/CD pipelines.
• Serve as the technical escalation point for security incidents and cryptographic design decisions.

What we're looking for

• 7–10 years of experience in software engineering with a focus on application security, cryptography, or secure systems design.
• Production-level proficiency in backend Java for building security-critical, enterprise-grade services.
• Hands-on experience integrating Hardware Security Modules (HSMs) via PKCS#11, JCE/JCA, or vendor-specific APIs.
• Practical understanding of Multi-Party Computation (MPC) protocols, threshold signature schemes (TSS), or distributed key management.
• Deep knowledge of applied cryptography, including symmetric/asymmetric encryption, digital signatures, and PKI/X.509 certificate management.
• Familiarity with secure design patterns such as zero-trust, secrets management, mTLS, and secure enclave technologies.
• Experience with threat modelling frameworks and CI/CD security tooling like SAST, DAST, and dependency scanning.
• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or a related technical discipline.
• Master's or PhD in Cryptography, Information Security, or Computer Science (preferred).
• Experience in digital asset custody, blockchain key management, or institutional crypto infrastructure (preferred).
• Knowledge of financial services regulatory frameworks like NIST SP 800-57, FIPS 140-2/3, or PCI-DSS (preferred).
• Background in penetration testing, red team exercises, or formal security certifications like CISSP, CSSP, CEH, or OSCP (preferred).