Bitcoin Security Engineer

Strategy; Tysons (VA); On-site; USD 104,000 - 187,000; Full time

Job summary

Strategy is expanding its Bitcoin Security program with a dedicated offensive-security function. The Bitcoin Security Engineer role is hands-on and highly technical, focusing on cryptographic key materials, signing ceremonies, custody controls, and related infrastructure.

You will probe wallets, hardware, protocols, and custodial processes to identify weaknesses before adversaries do. Based in Tysons Corner, Virginia, this on-site role requires leadership in threat modeling, vulnerability

Qualifications

• Bachelor's degree in CS, Cryptography, InfoSec, Engineering, or related field.
• Master's degree strongly preferred; equivalent offensive-security experience considered.
• 6+ years of hands-on pentesting/red-team in cryptographic/financial/blockchain environments.

Responsibilities

• Bitcoin & Wallet Penetration Testing across single-sig, multisig, MPC, and hardware wallets.
• Design adversarial simulations of signing ceremonies and transaction workflows.
• Test hardware wallets, HSMs, secure elements, and air-gapped devices.
• Test Bitcoin node, RPC, PSBT handling, and derived-path validation.
• Assess blockchain-adjacent tech: smart contracts, bridges, oracles, on-chain logic.
• Lead security research into custodians and third-party services with threat modeling.
• Maintain threat models and attack surface inventories for custody chain.
• Produce clear, reproducible reports with POC exploits and remediation steps.
• Develop tooling and automation for repeatable bitcoin security testing.

Skills

Penetration testing

Red team

Crypto systems

Bitcoin testing

Key management

HSMs

PSBT

Multisignature

MPC

Python

Rust

C/C++

Go

Threat modeling

Communication skills

Adversarial testing

Education

Bachelor's degree in Computer Science, Cryptography, Information Security, Engineering, or related field

Master's degree in a relevant discipline

Tools

OSCP/OSEP/OSED

GIAC/GREM/GWAPT

Blockchain security credentials

Python tooling

Job description

Company Description

Strategy (Nasdaq: MSTR) is at the forefront of transforming organizations into intelligent enterprises through data-driven innovation. We don't just follow trends—we set them and drive change. As a market leader in enterprise analytics and AI software, we've pioneered the BI and analytics space, empowering people to make better decisions and revolutionizing how businesses operate. We are now also at the forefront of AI disruption, providing data via our enterprise semantic layer to AI agents, tools, and platforms.

But that's not all. Strategy is also leading a groundbreaking shift in digital assets, adopting bitcoin as our primary treasury reserve asset in 2020. Since then, we have issued innovative bitcoin-backed securities and have been the leader in bitcoin treasury companies. This visionary move has helped us build a fortress balance sheet, and is solidifying our position as a forward-thinking, innovative force in the market.

Our people are the core of our success. At Strategy, you'll join a team of smart, creative minds working on dynamic projects with cutting‑edge technologies. We thrive on curiosity, innovation, and a relentless pursuit of excellence.

Our corporate values—bold, agile, engaged, impactful, and united—are the foundation of our culture. As we lead the charge into the new era of AI and financial innovation, we foster an environment where every employee's contributions are recognized and valued.

Join us and be part of an organization that lives and breathes innovation every day. At Strategy, you're not just another employee, you're a crucial part of a mission to push the boundaries of analytics and redefine financial investment.

Job Description

• This is a fully on‑site position, Monday through Friday, from 8:30 AM to 6:00 PM, based at our Tysons Corner, Virginia office.
• As a first step in our recruiting process, you will be asked to complete an Analytics Assessment and a Cultural Assessment. You will receive both assessments via email through Canditech.

Strategy is expanding its Bitcoin Security program with a dedicated offensive‑security function to continuously test, validate, and harden the security of Strategy's bitcoin holdings, custody relationships, and supporting infrastructure. The Bitcoin Security Engineer is a hands‑on, deeply technical individual‑contributor role responsible for adversarially assessing every layer of Strategy's bitcoin security posture—from cryptographic key material and signing ceremonies to the custodians, exchanges, and service providers that safeguard institutional‑scale bitcoin.

Where the Director of Bitcoin Security sets architecture and strategy, this role validates it—probing wallets, hardware, protocols, and custodial controls to find weaknesses before adversaries do, and producing rigorous research and analysis that raises the security bar across the bitcoin custody ecosystem.

• Bitcoin & Wallet Penetration Testing: Plan and execute hands‑on penetration tests against Strategy's bitcoin wallet architectures, including single‑sig, multisignature, MPC, and hardware‑wallet deployments, targeting key generation, storage, backup, and recovery workflows for exploitable weaknesses.
• Signing Ceremony & Custody Red‑Teaming: Design and run adversarial simulations of signing ceremonies, quorum policies, and transaction‑approval workflows, testing for insider‑threat, social‑engineering, collusion, and operational‑security failure modes across cold, warm, and hot storage tiers.
• Hardware & Cryptographic Testing: Perform security testing of hardware wallets, HSMs, secure elements, and air‑gapped devices, including firmware analysis, fault‑injection and side‑channel research, entropy and RNG validation, and supply‑chain tamper assessment.
• Protocol, Node & Transaction‑Layer Testing: Test Bitcoin node, RPC, and transaction‑construction surfaces, including PSBT handling, fee and RBF logic, transaction malleability, address‑generation and derivation‑path validation, and P2P/mempool‑facing attack surfaces.
• Blockchain Application Security: Assess the security of blockchain‑adjacent infrastructure Strategy relies on, including smart contracts, tokenization platforms, bridges, oracles, and on‑chain settlement logic, for vulnerabilities and abuse conditions.
• Elevated Custodian Security Research & Analysis: Lead deep offensive and analytical research into the security posture of Strategy's custodians and prospective custodians, including qualified custodians, exchanges, and asset servicers, pressure‑testing their key‑management, segregation, access‑control, and recovery claims through structured technical due diligence and adversarial threat modeling.
• Threat Modeling & Attack Surface Mapping: Build and maintain comprehensive threat models and attack‑surface inventories for Strategy's end‑to‑end bitcoin custody chain, prioritizing findings by realistic adversary capability and financial impact.
• Findings, Reporting & Remediation Support: Produce clear, reproducible penetration‑test reports with proof‑of‑concept exploits, severity ratings, and pragmatic remediation guidance, and partner with engineering and custody teams to validate fixes through retesting.
• Security Research & Community Engagement: Conduct original research into emerging bitcoin, cryptography, and blockchain vulnerabilities; responsibly disclose findings; and represent Strategy within the global bitcoin security community, including exchanges, custodians, service providers, and core developers.
• Tooling & Automation: Develop custom tooling, harnesses, fuzzers, and test automation to make bitcoin and custody security testing repeatable, scalable, and continuous.

Qualifications

• Advanced Technical Education: Bachelor's degree required in Computer Science, Cryptography, Information Security, Engineering, or a related field; Master's Degree in a relevant discipline strongly preferred. Equivalent demonstrable offensive‑security experience will be considered.
• Offensive Security Experience: 6+ years of hands‑on penetration testing, red‑team, vulnerability research, or exploit‑development experience, with a substantial portion focused on cryptographic systems, financial systems, or blockchain and bitcoin environments.
• Security Certifications: One or more recognized offensive‑security or blockchain‑security credentials strongly preferred, such as OSCP, OSEP, or OSED (Offensive Security); GPEN, GXPN, GWAPT, or GREM (GIAC/SANS); CRTO or CRTL (Zero‑Point Security); or a Certified Blockchain Security Professional credential.
• Bitcoin & Blockchain Testing Expertise: Demonstrated hands‑on ability to test Bitcoin protocol, wallet, and node implementations, covering key management, multisignature and MPC schemes, PSBT and transaction construction, derivation paths, and on‑chain and off‑chain attack surfaces.
• Cryptographic Systems & Key Management Proficiency: Deep understanding of cryptographic primitives and protocols, including digital signatures, hashing, key generation, entropy sources, secure key storage, and hardware‑backed security mechanisms, and how they fail in real deployments.
• Bitcoin Custody & Wallet Assessment: Experience adversarially assessing Bitcoin custody solutions, including multisignature and hardware wallets, HSMs, recovery mechanisms, signing ceremonies, and operational security controls, with the ability to evaluate third‑party custodian security claims.
• Security Research & Threat Analysis: Proven ability to conduct and document original security research and structured technical analysis of custodian, cryptographic, and blockchain systems, translating findings into defensible risk and remediation conclusions.
• Exploit Development & Tooling: Proficiency in one or more of Python, Rust, C/C++, or Go, with the ability to build custom test tooling, fuzzers, and proof‑of‑concept exploits.
• Communication Skills: Strong written and verbal communication skills with the ability to translate highly technical offensive findings into actionable guidance for engineers, custody teams, executives, and non‑technical stakeholders.
• Independent Judgment & Ethics: Demonstrated success operating as a senior individual contributor with high autonomy and sound judgment, and the discipline to handle highly sensitive systems and material safely, ethically, and within authorized scope.

Compensation

The base salary range for this role is $103,900to $186,900andrepresentsa good faith estimate of the range at the time of posting.Strategymaintainsbroad salary ranges to account for differences in skills, experience, qualifications, internal peer equity, market conditions, and business needs. Candidates are typically placed within the range based on these factors, and it is not common for individuals to be hired at or near the top of the range. The posted range reflects base salary only. Eligible employees may also participate in bonus programs, sales incentives, equity awards, and comprehensive benefits, as applicable.

Additional Information

Strategy is an equal opportunity employer. All applicants will receive consideration for employment without regard to race, creed, color, religion, national origin, gender, sex, sexual orientation, gender identity, disability, veteran status, age, genetic information, or any other legally‑protected basis.

Strategy provides reasonable accommodation for qualified individuals with disabilities in the hiring process. If you have any difficulty using our online system and you need an accommodation due to a disability, you may contact us about your interest in employment at [e-mail].

Visit Strategy’s Careers page for additional information.