Senior Security Engineer - xStocks

About the Team

xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains. Built within Payward, the xStocks team runs the infrastructure that issues, custodies, and settles these instruments across EVM, Solana, TON, Tron, and more.

The platform moves real value, so security is not a feature bolted on at the end—it is a property of everything the team ships. This is a hybrid engineering and security seat built for someone who is genuinely both: you ship products alongside the engineering team when the security queue is quiet, and you own security work end to end when it lands. You report into engineering and partner closely with the Payward security, CISO, and compliance functions.

The Opportunity

• Own security deliverables end to end: Coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes.
• Run offensive assessments: Pentest web apps, APIs, backend services, and on-chain components, and build the tooling to execute tests repeatedly.
• Continuously assess posture: Threat-model new and existing systems, review architecture and key-management flows, and maintain a living view of risks and mitigations.
• Review code for security: Act as a default reviewer on changes touching auth, cryptography, custody, signing, and fund movement across supported chains.
• Harden the platform: Improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events.
• Secure custody and signing workflows: Review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.
• Contribute to product engineering: Pick up regular backlog work in TypeScript to stay close to the codebase you defend.
• Support incidents: Assist with detection, triage, response, and post-mortems, feeding lessons back into the engineering program.

What You Bring

• Engineering-first mindset: Ability to write and review production code comfortably in TypeScript and Node.js, understanding systems deeply enough to break them.
• Application and infrastructure security fundamentals: Solid understanding of OWASP vulnerabilities, authn/authz, injection, SSRF, supply-chain risk, and secure design, paired with offensive experience in pentesting, vuln research, or red-teaming.
• Applied cryptography and blockchain security: Familiarity with symmetric and asymmetric primitives, hashing, signatures, key management, and the security models of EVM, Solana, and ideally TON or Tron. Ability to evaluate smart contracts and reason about failure modes.
• Ownership: Proven capability to drive ambiguous security items, audits, questionnaires, or incidents to closure independently.
• Clear communication: Skill in explaining risk and tailoring messages effectively to engineers, CISOs, and auditors alike.
• Automation instinct: Drive to turn manual findings into automated tests, alerts, controls, documentation, or platform enhancements.
• Risk judgment: Pragmatic understanding of theoretical versus material issues, communicating severity, likelihood, impact, and remediation tradeoffs.

Nice to Have

• Experience commissioning or remediating third-party smart-contract audits.
• Familiarity with custody and signing infrastructure (HSMs, MPC, Fordefi-style providers) and on-chain transaction security.
• Cloud security depth in GCP or AWS, IAM, and container/runtime hardening.
• Detection engineering and security observability experience, including SIEM and log-based detections.
• Relevant certifications such as OSCP, OSWE, or GWAPT.
• Prior work in a regulated fintech, tokenization, or DeFi environment.