Bitcoin Security Engineer

As a Bitcoin Security Engineer at Strategy (Nasdaq: MSTR), you conduct hands-on offensive security testing and adversarial assessment of Strategy's bitcoin holdings, custody relationships, and supporting infrastructure. You work as a deeply technical individual contributor, probing wallets, hardware, protocols, and custodial controls to find weaknesses before adversaries do, and producing rigorous research that raises the security bar across the bitcoin custody ecosystem.

What you'll do

• Plan and execute hands-on penetration tests against Strategy's bitcoin wallet architectures, including single-sig, multisignature, MPC, and hardware-wallet deployments, targeting key generation, storage, backup, and recovery workflows for exploitable weaknesses.
• Design and run adversarial simulations of signing ceremonies, quorum policies, and transaction-approval workflows, testing for insider-threat, social-engineering, collusion, and operational-security failure modes across cold, warm, and hot storage tiers.
• Perform security testing of hardware wallets, HSMs, secure elements, and air-gapped devices, including firmware analysis, fault-injection and side-channel research, entropy and RNG validation, and supply-chain tamper assessment.
• Test Bitcoin node, RPC, and transaction-construction surfaces, including PSBT handling, fee and RBF logic, transaction malleability, address-generation and derivation-path validation, and P2P/mempool-facing attack surfaces.
• Assess the security of blockchain-adjacent infrastructure Strategy relies on, including smart contracts, tokenization platforms, bridges, oracles, and on-chain settlement logic, for vulnerabilities and abuse conditions.
• Lead deep offensive and analytical research into the security posture of Strategy's custodians and prospective custodians, including qualified custodians, exchanges, and asset servicers, pressure-testing their key-management, segregation, access-control, and recovery claims through structured technical due diligence and adversarial threat modeling.
• Build and maintain comprehensive threat models and attack-surface inventories for Strategy's end-to-end bitcoin custody chain, prioritizing findings by realistic adversary capability and financial impact.
• Produce clear, reproducible penetration-test reports with proof-of-concept exploits, severity ratings, and pragmatic remediation guidance, and partner with engineering and custody teams to validate fixes through retesting.
• Conduct original research into emerging bitcoin, cryptography, and blockchain vulnerabilities, responsibly disclose findings, and represent Strategy within the global bitcoin security community, including exchanges, custodians, service providers, and core developers.
• Develop custom tooling, harnesses, fuzzers, and test automation to make bitcoin and custody security testing repeatable, scalable, and continuous.

What you bring

• A Bachelor's degree in Computer Science, Cryptography, Information Security, Engineering, or a related field (or equivalent demonstrable offensive-security experience).
• 6+ years of hands-on penetration testing, red-team, vulnerability research, or exploit-development experience, with a substantial portion focused on cryptographic systems, financial systems, or blockchain and bitcoin environments.
• Demonstrated hands-on ability to test Bitcoin protocol, wallet, and node implementations, covering key management, multisignature and MPC schemes, PSBT and transaction construction, derivation paths, and on-chain and off-chain attack surfaces.
• Deep understanding of cryptographic primitives and protocols, including digital signatures, hashing, key generation, entropy sources, secure key storage, and hardware-backed security mechanisms, and how they fail in real deployments.
• Experience adversarially assessing Bitcoin custody solutions, including multisignature and hardware wallets, HSMs, recovery mechanisms, signing ceremonies, and operational security controls, with the ability to evaluate third-party custodian security claims.
• Proven ability to conduct and document original security research and structured technical analysis of custodian, cryptographic, and blockchain systems, translating findings into defensible risk and remediation conclusions.
• Proficiency in one or more of Python, Rust, C/C++, or Go, with the ability to build custom test tooling, fuzzers, and proof-of-concept exploits.
• Strong written and verbal communication skills with the ability to translate highly technical offensive findings into actionable guidance for engineers, custody teams, executives, and non-technical stakeholders.
• Demonstrated success operating as a senior individual contributor with high autonomy and sound judgment, and the discipline to handle highly sensitive systems and material safely, ethically, and within authorized scope.

Nice to have

• A Master's Degree in a relevant discipline.
• One or more recognized offensive-security or blockchain-security credentials such as OSCP, OSEP, OSED, GPEN, GXPN, GWAPT, GREM, CRTO, CRTL, or a Certified Blockchain Security Professional credential.

What we offer

• Base salary of $103,900 to $186,900.
• Eligible employees may participate in bonus programs, sales incentives, equity awards, and comprehensive benefits.
• Fully on-site position, Monday through Friday, 8:30 AM to 6:00 PM, based at our Tysons Corner, Virginia office.

About Strategy

Strategy (Nasdaq: MSTR) is a market leader in enterprise analytics and AI software, pioneering the BI space and providing data via its enterprise semantic layer to AI agents and platforms. Strategy is also leading a groundbreaking shift in digital assets, adopting bitcoin as its primary treasury reserve asset since 2020, and has issued innovative bitcoin-backed securities, establishing itself as the leader in bitcoin treasury companies.