高级安全工程师(Senior Security Engineer)

PromptCube; New York (NY); Remote; USD 180,000 - 250,000; Full time

Job summary

Bastion 正在招募一名动手能力强的高级安全工程师，直接向 CTO/CISO 汇报，参与从安全工程到检测与响应的全栈工作。平台以 Go 编写，运行在 AWS 的 Kubernetes(EKS) 上，使用 Terraform 管理，安全服务同样用 Go 编写，需具备产出能力并能在美区远程工作。

岗位远程工作在美国境内可选，优先考虑居住在 NYC 或愿意搬迁者。加入后将参与 SOC1、SOC2、OCC、MiCA/DORA 等监管工作流与审计自动化。

Qualifications

• 必须能够编写生产代码，Go 为主。
• 具备动手实践的资深安全工程能力，覆盖工程、基础设施、产品与应用安全、检测与响应及 GRC 技术侧。
• 适应初创公司的快节奏与变化，能在短期内产生实质性贡献。

Responsibilities

• 从入职第一周开始熟悉 Go 代码库、AWS 与 Kubernetes 环境，提供设计文档的安全评审并上线首个安全修复。
• 参与事件响应与值班流程，了解 DLP 项目并推进落地。
• 在约 90 天内全权负责至少一个安全领域并成为领域负责人。
• 以代码形式编写检测规则，接入新遥测来源，降低告警噪声。
• 用 Go 交付可复用的安全库或中间件并推动服务组采纳。
• 对新产品功能与架构变更进行安全评审，交付对审计的自动化证据。
• 参与启动并分诊漏洞赏金，扩展 DLP 覆盖与策略。

Skills

Go 编程

AWS

Kubernetes

安全工具开发

事件响应

On-Call 演练

Tools

Terraform

SIEM

Job description

岗位概况

Bastion 是一家提供受监管稳定币基础设施的公司，产品包括托管钱包、全球支付编排与稳定币发行，团队约 40 人。 现招聘动手能力强的安全团队第二名工程师，与 Staff Security Engineer 共事，直接向 CTO/CISO 汇报。 工作覆盖安全工程、基础设施、产品与应用安全、检测与响应，以及 SOC 1、SOC 2、OCC、MiCA/DORA 的技术侧 GRC；平台几乎全部使用 Go，运行于 AWS 上的 Kubernetes（EKS），以 Terraform 管理，安全服务同样用 Go 编写，需要能编写生产代码。 岗位可在美国境内远程。

工作职责

• 从入职第一周起上手 Go 代码库、AWS 与 Kubernetes（EKS）环境、SIEM 及安全服务，向至少一份工程设计文档提供安全评审意见，并把首个安全修复、护栏或检测上线到生产环境。
• 熟悉事件响应与值班流程，加入安全值班轮值以保障团队覆盖，并了解 DLP 项目、开始参与其落地推进。
• 在约 90 天内端到端负责至少一个安全领域，例如 Kubernetes 与云加固、CI 中的应用安全，或检测工程，并成为该领域的公认负责人。
• 以代码形式编写和调优检测规则，接入新的遥测来源，并减少告警噪声。
• 用 Go 交付首个可复用的安全库或中间件（例如授权、租户隔离、请求签名、输入校验），并推动至少一个服务团队采纳。
• 担任新产品功能与架构变更设计文档的安全评审人，并为进行中的审计或监管工作流（SOC 1、SOC 2、OCC）交付控制自动化与证据。
• 协助启动与分诊漏洞赏金项目，并扩大 DLP 的覆盖范围与策略。
• 在约 180 天内推动多季度计划，例如服务间默认拒绝网络、安全策略评估，或将即时、细粒度访问扩展到更多系统；扩展 Kubernetes 集群与容器安全（镜像扫描与签名、准入策略、Pod 安全标准、运行时保护）。
• 扩大跨代码库采用的安全中间件与库，参与跨职能规划并影响安全路线图，把桌面演练与韧性测试转化为具体修复，并以自动化而非电子表格扩充合规范围。

任职要求

• 必须能够编写生产代码；平台与安全服务几乎全部使用 Go，日常工作大多数时间用于写代码、评审设计文档、构建可被任意服务轻松接入的安全工具与中间件。
• 具备动手实践（hands-on）的资深安全工程能力，可覆盖安全工程、基础设施、产品与应用安全、检测与响应，以及 SOC 1、SOC 2、OCC、MiCA/DORA 相关的技术侧 GRC。
• 能适应早期创业公司的快节奏与不断变化的工作内容：期望第一周即有实际贡献，第三个月达到完全产出。
• 工作基于已有的安全基础（SOC 2 Type II 报告、OCC 全国信托牌照的有条件批准、SIEM 与检测流水线、Kubernetes 运行时安全、限时且可审计的生产访问）继续扩展。

申请条件与限制

• 该岗位可在美国境内远程；原招聘表示更偏好现居纽约市（NYC）或愿意搬迁者。
• 公司参与 E-Verify，用于核实在美国的就业资格。
• 需加入安全值班轮值（on-call），承担实际覆盖。
• 公司为所有员工与求职者提供平等就业机会，禁止任何形式的歧视与骚扰，该政策适用于包括招聘、录用与安置在内的所有雇佣条款与条件。
• 原招聘未注明雇佣类型（employment_type 为空），也未明确具体时区、语言与出差要求。

加分项

• 优先考虑现居纽约市（NYC）或愿意搬迁至纽约市的候选人。

薪酬与福利

• 薪酬范围：$180K - $250K（按原招聘原文列出，未注明币种与支付周期）。
• 原招聘未提及股权/代币、保险、休假、津贴等其他福利。

国际远程岗位，招聘地区：Remote (US Remote; New York City)。 请核对原招聘中的居住地、工作许可、时区、语言与出差要求；远程岗位不等于全球可申请。 以下保留招聘来源英文原文。

Source job listing. Remote does not imply worldwide eligibility; confirm residency, time zone, language and work authorization on the original page.

About Bastion

Bastion provides the regulated infrastructure businesses need to hold, move, and issue stablecoins. Our platform combines custodial wallets, global payment orchestration, and stablecoin issuance. Customers can use each product independently or connect them into a single end-to-end flow.

We operate through our own regulated entities, with compliance and risk controls built directly into the platform. We can also support customers operating under their own licenses with the compliance and financial operations required to run their programs.

Overview

We're looking for a hands-on Senior Security Engineer to join our security team as its second engineer. You'll work alongside our Staff Security Engineer and report to our CTO/CISO.

The foundation is already in place: a SOC 2 Type II report, conditional approval from the OCC for a national trust charter, a SIEM and detection pipeline, runtime security for Kubernetes, and time-limited, auditable access to production. You'll help scale that program across security engineering, infrastructure, product and application security, detection and response, and the technical side of GRC (SOC 1, SOC 2, OCC, and MiCA/DORA).

As a 40-person company, your work will directly protect our users and partners. You'll build on a strong foundation (we're featured in this AWS case study). Our platform is almost entirely Go, running on Kubernetes (EKS) in AWS and managed with Terraform, and our security services are written in Go too. You must be able to write production code. Expect to spend most of your time writing code, reviewing design docs, and building security tooling and middleware that engineers can easily drop into any service.

This role can be remote within the US, though we'd prefer someone in NYC or open to relocating.

Work to Be Done

Instead of a list of requirements, we want to give you a directional look into the first 30, 90, and 180 days on the job.

We are a startup, so the pace is fast and the specific work will change. People who thrive here find ways to contribute in their first week and are fully productive by their third month. You need to be okay with that.

First 30 days: Learn and ship from week one

• Get hands-on with our Go codebase, AWS and Kubernetes environment, SIEM, and security services
• Contribute security feedback to at least one engineering design doc
• Ship your first security fix, guardrail, or detection to production
• Learn our incident response and on-call procedures, and join our security rotation
• Get up to speed on our DLP program and start contributing to its rollout
• Join the security on-call rotation, so the team has real coverage

By 90 days: Own initiatives independently

• Own at least one security domain end to end, such as Kubernetes and cloud hardening, application security in CI, or detection engineering
• Write and tune detections as code, add new telemetry sources, and reduce alert noise
• Ship your first reusable security library or middleware in Go (for example authorization, tenant isolation, request signing, or input validation) and get it adopted by at least one service team
• Be the security reviewer on design docs for new product features and architecture changes
• Deliver control automation and evidence for an active audit or regulatory workstream (SOC 1, SOC 2, OCC)
• Help launch and triage our bug bounty program, and grow our DLP coverage and policies
• Recognized as the owner of at least one security domain

By 180 days: Scale your impact

• Drive multi-quarter initiatives such as default-deny service-to-service networking, security policy evaluation, or just-in-time, granular access across more systems
• Expand our Kubernetes cluster and container security, including image scanning and signing, admission policies, pod security standards, and runtime protection
• Grow a shared set of security middleware and libraries that is adopted across the codebase, so the secure path is the easy path for our Go engineers
• Help expand our compliance scope with automation instead of spreadsheets
• Turn tabletop exercises and resilience testing into concrete fixes
• Join cross-functional planning and influence the security roadmap
• Clear, measurable business impact from your security work

Some challenges you might tackle

• Building reusable security building blocks that make secure defaults easy across our platform
• Protecting the critical systems at the core of a regulated stablecoin platform
• Turning OCC and MiCA/DORA requirements into controls that are engineered, tested, and continuously evidenced
• Building high-signal detections across cloud, Kubernetes, identity, endpoint, and SaaS telemetry
• Hardening our Kubernetes clusters and container supply chain, from build to admission to runtime, without slowing deploys

Bastion provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, and placement. Bastion participates in E-Verify to authorize eligibility of employment in the United States.

Compensation Range: $180K - $250K