Senior Security Engineer

• Coordinate and review smart-contract audits
• Respond to security questionnaires and due-diligence requests
• Support CISO and compliance initiatives
• Track findings through completed remediation
• Conduct penetration tests of web applications, APIs, backend services, and on-chain components
• Build repeatable security assessment tooling
• Threat-model new and existing systems
• Review architecture and key-management flows
• Maintain a current view of risks and mitigations
• Review code involving authentication, cryptography, custody, signing, and fund movement across blockchains
• Improve secrets handling, IAM, least privilege, dependency and supply-chain security, detection, and logging
• Secure custody and signing workflows, including MPC/HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures
• Contribute TypeScript product-engineering backlog work
• Support security detection, triage, incident response, and post-mortems
• Partner with Payward security, CISO, and compliance functions
• Report into engineering

• Production code development and review experience, especially TypeScript and Node.js
• Strong application and infrastructure security fundamentals, including OWASP-class vulnerabilities, authentication and authorization, injection, SSRF, supply-chain risk, and secure design
• Hands-on offensive security experience in penetration testing, vulnerability research, or red teaming
• Applied cryptography knowledge, including symmetric and asymmetric primitives, hashing, signatures, and key management
• Blockchain security knowledge across EVM and Solana; ideally TON or Tron
• Ability to read smart contracts and reason about failure modes
• Ability to independently drive ambiguous security work, audits, questionnaires, or incidents to closure
• Ability to communicate risks to engineers, a CISO, and auditors
• Automation-oriented approach to converting findings into tests, alerts, controls, documentation, or platform improvements
• Ability to assess severity, likelihood, impact, and remediation tradeoffs
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers (nice to have)
• Cloud security experience in GCP or AWS, IAM, and container/runtime hardening (nice to have)
• Detection engineering and security observability, including SIEM and log-based detections (nice to have)
• OSCP, OSWE, or GWAPT certification (nice to have)
• Prior experience in regulated fintech or tokenization/DeFi (nice to have)
• Ability to work from an eligible country/location and address work sponsorship requirements

• Opportunity to work at Payward, the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks
• Remote work arrangement
• Work alongside global teams and diverse colleagues
• Applications accepted on an ongoing basis unless a deadline is stated
• Equal opportunity employment
• Job-related skills or work-style assessments considered alongside experience and interviews
• Kraken product dogfooding after joining