Senior Security Engineer - xStocks

As a Senior Security Engineer for xStocks at Payward, you own security end to end for a platform that brings real-world assets on-chain as tokenized securities across EVM, Solana, TON, Tron, and more. This is a hybrid engineering and security role: you ship products with the engineering team when the security queue is quiet, and you own security work end to end when it lands. You report into engineering and partner closely with Payward's security, CISO, and compliance functions.

What you'll do

• Own security deliverables end to end, including coordinating and reviewing smart-contract audits, responding to security questionnaires and due-diligence requests, supporting CISO and compliance initiatives, and tracking findings to closure.
• Run offensive assessments against the platforms, including pentesting web apps, APIs, backend services, and on-chain components, and build tooling to run assessments repeatedly rather than once.
• Continuously assess security posture by threat-modelling new and existing systems, reviewing architecture and key-management flows, and maintaining a living view of risks and their mitigations.
• Review code for security as a default reviewer on changes touching authentication, cryptography, custody, signing, and fund movement across the chains.
• Harden the platform by improving secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
• Secure custody and signing workflows by reviewing and hardening transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Contribute to product engineering by picking up regular backlog work in TypeScript to stay close to the codebase you are defending.
• Support incidents by helping with detection, triage, response, and post-mortems, and feeding lessons back into the security program.

What you bring

• Strong production engineering skills in TypeScript and Node.js, with the ability to write and review code comfortably and understand systems deeply enough to break them.
• Strong application and infrastructure security fundamentals, including the OWASP-class vulnerability landscape, authentication and authorization, injection, SSRF, supply-chain risk, and secure design, backed by real offensive work in pentesting, vulnerability research, or red-team operations.
• Applied cryptography and blockchain security knowledge: symmetric and asymmetric primitives, hashing, signatures, key management, and the security model of EVM, Solana, and ideally TON or Tron, plus the ability to read a smart contract and reason about how it fails.
• Ownership: the ability to take an ambiguous security item, audit, questionnaire, or incident and drive it to closure without being managed through it.
• Clear communication: you can explain a risk to engineers, a CISO, and an auditor, tailoring the message to each audience.
• An automation instinct: you turn findings into tests, alerts, controls, documentation, or platform improvements rather than repeating manual work.
• Risk judgment: you can tell a theoretical issue from a material one and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

Nice to have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.
• Cloud security depth in GCP or AWS, including IAM and container and runtime hardening.
• Detection engineering and security observability, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech or tokenization/DeFi environment.

About Payward

Payward is the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services, and CF Benchmarks. Over the last 15 years, it has built one of the most modern and globally accessible financial infrastructure platforms in the industry, advancing an open, global financial system.