Application Security Engineer - Blockchain & Cloud

The Bitcoin Street Journal; New York, Northern (NY, KY); Hybrid; USD 140,000 - 210,000; Full time

Benefits offered by this job

Unlimited time off

Flexible working (work from home or in

Health and wellness stipend

401(k) with company match

Equity plan

In-office meals

Team summits

Job summary

Rain is seeking an application security expert to own the quality bar for non-blockchain findings and to lead security decisions across backend services, APIs, cloud, and edge. You’ll collaborate with engineers to determine what is real, how severe it is, and what must be fixed before launch.

You will drive threat modeling, implement secure baselines, and strengthen defenses across money-moving paths, with a focus on practical, auditable security controls and AI-assisted tooling.

Qualifications

• 4+ years in application security, product security, or security-minded backend engineering.
• Ability to read unfamiliar codebases (TypeScript/Node.js) and identify critical bugs.
• Hands-on cloud security experience (preferably GCP) and edge defenses like WAFs.

Responsibilities

• Review red team findings before they reach engineers; reproduce, prune false positives, set severity, and write clear tickets.
• Harden backend services and APIs, especially money-moving paths; often implement fixes.
• Own edge defenses: DDoS protection, rate limiting, WAF rules, and abuse controls.
• Write secure configuration baselines for cloud, code, and SaaS; automate checks.
• Grow the PR security gate to block more bugs before merge.
• Own attack surface coverage and conduct architecture reviews for high-risk systems.

Skills

Security mindset

Node.js/TypeScript

Cloud security

Terraform

WAFs & rate limiting

Threat modeling

Architecture reviews

Security tooling

Tools

Terraform

LLM-based review tools

Static analysis tools

Job description

Rain is seeking an application security expert to own the quality bar for non-blockchain findings and to lead security decisions across backend services, APIs, cloud, and edge. You’ll collaborate with engineers to determine what is real, how severe it is, and what must be fixed before launch.

You will drive threat modeling, implement secure baselines, and strengthen defenses across money-moving paths, with a focus on practical, auditable security controls and AI-assisted tooling.