Senior Security Engineer - xStocks

As a Senior Security Engineer at xStocks, you own security end to end for a platform that brings real-world assets on-chain as tokenized securities across EVM, Solana, TON, Tron, and more. Built within Payward, xStocks moves real value, and security is a property of everything the team ships. This is a hybrid engineering and security role: you ship products alongside the engineering team when the security queue is quiet, and you own security work end to end when it lands. You report into engineering and partner closely with Payward's security, CISO, and compliance functions.

What you'll do

• Own security deliverables end to end: coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes.
• Run offensive assessments against the platforms: pentest web apps, APIs, backend services, and on-chain components, and build the tooling to do it repeatedly rather than once.
• Continuously assess security posture: threat-model new and existing systems, review architecture and key-management flows, and maintain a living view of risks and their mitigations.
• Review code for security, serving as a default reviewer on changes touching authentication, cryptography, custody, signing, and fund movement across chains.
• Harden the platform: improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
• Secure custody and signing workflows: review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Contribute to product engineering: pick up regular backlog work in TypeScript so you stay close to the codebase you are defending.
• Support incidents: help with detection, triage, response, and post-mortems, and feed the lessons back into the program.

What you bring

• You are an engineer first: you write and review production code comfortably in TypeScript and Node.js, and you understand systems deeply enough to break them.
• Strong application and infrastructure security fundamentals: the OWASP-class vulnerability landscape, authentication and authorization, injection, SSRF, supply-chain risk, and secure design, with real offensive work in pentesting, vulnerability research, or red-team.
• Applied cryptography and blockchain security: understanding of symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron, and the ability to read a smart contract and reason about how it fails.
• Ownership: you can take an ambiguous security item, an audit, a questionnaire, or an incident and drive it to closure without being managed through it.
• Clear communication: you can explain a risk to engineers, a CISO, and an auditor, and tailor the message to each audience.
• An automation instinct: you do not want to catch the same issue manually twice, so you turn findings into tests, alerts, controls, documentation, or platform improvements.
• Risk judgment: you can tell a theoretical issue from a material one and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
• Cloud security depth in GCP or AWS, including IAM and container and runtime hardening.
• Detection engineering and security observability, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech or tokenization and DeFi environment.

About xStocks and Payward

xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains. Built within Payward, the parent company behind Kraken, NinjaTrader, Breakout, and CF Benchmarks, xStocks has spent 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry.