Senior Security Engineer - xStocks

As a Senior Security Engineer for xStocks at Kraken, you join a hybrid engineering and security role built for someone who is both engineer and security specialist. xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains including EVM, Solana, TON, Tron, and more. The platform moves real value, so security is not a feature bolted on at the end-it is a property of everything the team ships. You ship products alongside the engineering team when the security queue is quiet, and you own security work end to end when it lands, reporting into engineering while partnering closely with Payward security, CISO, and compliance functions.

What you'll do

• Own security deliverables end to end, including coordinating and reviewing smart-contract audits, responding to security questionnaires and due-diligence requests, supporting CISO and compliance initiatives, and tracking fixes through to closure.
• Run offensive assessments against your own platforms, including penetesting web apps, APIs, backend services, and on-chain components, and build tooling to run these assessments repeatedly.
• Continuously assess security posture through threat-modelling new and existing systems, reviewing architecture and key-management flows, and maintaining a living view of risks and their mitigations.
• Review code for security as a default reviewer on changes touching authentication, cryptography, custody, signing, and fund movement across chains.
• Harden the platform by improving secrets handling, IAM and least-privilege access, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
• Secure custody and signing workflows by reviewing and hardening transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Contribute to product engineering by picking up regular backlog work in TypeScript to stay close to the codebase you defend.
• Support incidents through detection, triage, response, and post-mortems, feeding lessons back into the security program.

What you bring

• Strong engineering fundamentals: you write and review production code comfortably in TypeScript and Node.js, and you understand systems deeply enough to break them.
• Strong application and infrastructure security fundamentals covering the OWASP vulnerability landscape, authentication and authorization, injection, SSRF, supply-chain risk, and secure design, with real offensive work experience in pentesting, vulnerability research, or red-team activity.
• Applied cryptography and blockchain security knowledge, including symmetric and asymmetric primitives, hashing, signatures, key management, and the security model of EVM, Solana, and ideally TON or Tron, with the ability to read a smart contract and reason about its failure modes.
• Ownership: you can take an ambiguous security item, an audit finding, a questionnaire, or an incident and drive it to closure without being managed through it.
• Clear communication: you can explain a risk to engineers, to a CISO, and to an auditor, tailoring the message to each audience.
• An automation instinct: you turn findings into tests, alerts, controls, documentation, or platform improvements rather than catching the same issue manually twice.
• Risk judgment: you can distinguish a theoretical issue from a material one, and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
• Cloud security depth in GCP or AWS, including IAM and container and runtime hardening.
• Detection engineering and security observability, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech or tokenization and DeFi environment.

About Kraken

Payward, the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services, and CF Benchmarks, has spent 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system.