Senior Security Engineer - xStocks

As a Senior Security Engineer for xStocks at Kraken, you bring genuine depth in both product engineering and security to a platform that tokenizes real-world assets on-chain. xStocks issues, custodies, and settles regulated, fully-backed securities across EVM, Solana, TON, Tron, and more. This hybrid role sits at the intersection: you ship products alongside the engineering team and own security work end to end, reporting into engineering while partnering closely with Payward's security, CISO, and compliance functions. Security is not a feature bolted on at the end; it is a property of everything the team ships.

What you'll do

• Own security deliverables end to end: coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and drive findings to tracked, closed-out fixes.
• Run offensive assessments against the platforms, including pentests on web apps, APIs, backend services, and on-chain components, and build repeatable tooling rather than one-off assessments.
• Continuously assess security posture by threat-modeling new and existing systems, reviewing architecture and key-management flows, and maintaining a living view of risks and their mitigations.
• Review code for security on changes touching auth, cryptography, custody, signing, and fund movement across chains.
• Harden the platform by improving secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
• Secure custody and signing workflows by reviewing and hardening transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Contribute to product engineering by picking up regular backlog work in TypeScript to stay close to the codebase you are defending.
• Support incidents through detection, triage, response, and post-mortems, and feed lessons back into the security program.

What you bring

• An engineer first: you write and review production code comfortably in TypeScript and Node.js, and you understand systems deeply enough to break them.
• Strong application and infrastructure security fundamentals including the OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design, with real offensive work in pentesting, vuln research, or red-team.
• Applied cryptography and blockchain security: symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron; you can read a smart contract and reason about how it fails.
• Ownership to take an ambiguous security item, an audit, a questionnaire, or an incident and drive it to closure without being managed through it.
• Clear communication: you can explain a risk to engineers, a CISO, and an auditor, tailoring the message to each audience.
• An automation instinct: you turn findings into tests, alerts, controls, documentation, or platform improvements rather than catching the same issue manually twice.
• Risk judgment to distinguish theoretical issues from material ones, and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
• Cloud security depth in GCP or AWS, IAM, and container and runtime hardening.
• Detection engineering and security observability, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech or tokenization/DeFi environment.

About Kraken

Payward, the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services, and CF Benchmarks, has spent 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system.