Senior Security Engineer - xStocks

As a Senior Security Engineer at xStocks within Payward, you own security end to end for a platform that brings real-world assets on-chain as tokenized securities. You work in a hybrid engineering and security role, shipping product alongside the engineering team and driving security work from discovery to closure. The xStocks platform moves real value across EVM, Solana, TON, Tron, and more, so security is built into everything the team ships.

What you'll do

• Own security deliverables end to end, coordinating and reviewing smart-contract audits, responding to security questionnaires and due-diligence requests, and supporting CISO and compliance initiatives.
• Run offensive assessments against the platform, pentesting web apps, APIs, backend services, and on-chain components, and build tooling to repeat these tests systematically.
• Continuously assess security posture through threat modeling of new and existing systems, architecture reviews, key-management flow analysis, and maintaining a living view of risks and mitigations.
• Review code for security, serving as a default reviewer for changes touching authentication, cryptography, custody, signing, and fund movement across chains.
• Harden the platform by improving secrets handling, IAM and least-privilege policies, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
• Secure custody and signing workflows by reviewing and hardening transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Contribute to product engineering by picking up regular backlog work in TypeScript to stay close to the codebase you defend.
• Support incidents through detection, triage, response, and post-mortems, and feed lessons back into the security program.

What you bring

• Strong engineering fundamentals: you write and review production code comfortably in TypeScript and Node.js, and you understand systems deeply enough to break them.
• Application and infrastructure security expertise, including the OWASP vulnerability landscape, authentication and authorization, injection, SSRF, supply-chain risk, and secure design; you have performed real offensive work in pentesting, vulnerability research, or red-team activities.
• Applied cryptography and blockchain security knowledge: symmetric and asymmetric primitives, hashing, signatures, key management, and the security model of EVM and Solana; you can read a smart contract and reason about its failure modes.
• Ownership: you can take an ambiguous security item, audit, questionnaire, or incident and drive it to closure independently.
• Clear communication: you can explain risk to engineers, a CISO, and an auditor, tailoring your message to each audience.
• An automation instinct: you turn findings into tests, alerts, controls, documentation, or platform improvements rather than catching the same issue manually twice.
• Risk judgment: you distinguish theoretical issues from material ones and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
• Cloud security depth in GCP or AWS, including IAM and container and runtime hardening.
• Detection engineering and security observability, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech or tokenization and DeFi environment.

About Payward

Payward is the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services, and CF Benchmarks. For the last 15 years, Payward has built one of the most modern and globally accessible financial infrastructure platforms in the industry, designed to advance an open, global financial system.