Senior Security Engineer - xStocks

kraken.com; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

Kraken is seeking an experienced security engineer to own security reviews and production code contributions for a platform issuing, holding, and settling tokenized assets across multiple networks. You will collaborate with security, compliance, and executives to translate audit findings into improvements.

The role involves hands-on development in TypeScript, security testing of web/app and on-chain components, and proactive threat modeling to strengthen custody and signing controls.

Qualifications

• Production code experience in TypeScript/Node.js
• Strong security skills across web apps, APIs, and cloud infrastructure
• Offensive security with pentesting or red-team work
• Applied cryptography, signatures, hashing, and key management
• Blockchain security for EVM and Solana; smart contract review
• Clear communicator able to explain risk and remediation tradeoffs

Responsibilities

• Coordinate smart contract audits and security due diligence requests
• Test web applications, APIs, backend services, and on-chain components; build repeatable tools for security testing
• Threat-model systems and review architecture, including key-management flows
• Review sensitive code involving authentication, cryptography, custody, signing, and funds movement
• Improve secrets management, access controls, dependency security, runtime protections, logging, and detection
• Assess transaction signing and custody controls, including signer permissions and emergency procedures
• Contribute TypeScript product work and support incident triage and post-incident reviews

Job description

Role overview

Own security work for a platform that issues, holds, and settles tokenized real-world assets across several blockchain networks. This is a hands-on role embedded with product engineers: you’ll lead security reviews and assessments while also contributing production code when security priorities allow. You’ll partner with security, compliance, and executive stakeholders to turn risks and audit findings into completed improvements.

Responsibilities

• - Coordinate smart contract audits and handle security questionnaires and due diligence requests, tracking findings through remediation.
• - Test web applications, APIs, backend services, and on-chain components; build repeatable tools and processes for offensive assessments.
• - Threat-model systems, review architecture and key-management flows, and maintain clear records of risks and mitigations.
• - Review sensitive code involving authentication, cryptography, custody, signing, and movement of funds.
• - Improve secrets management, access controls, dependency security, runtime protections, logging, and detection.
• - Assess transaction signing and custody controls, including signer permissions, approval policies, and emergency procedures.
• - Contribute TypeScript product work, and support incident triage, response, and post-incident reviews.

Requirements

• - Comfortable writing and reviewing production code, especially with TypeScript and Node.js, and able to understand systems well enough to assess how they can fail.
• - Strong application and infrastructure security skills, including common web vulnerabilities, authentication and authorization, injection, SSRF, supply-chain risk, and secure design.
• - Practical offensive security experience through penetration testing, vulnerability research, or red-team work.
• - Applied knowledge of cryptographic primitives, signatures, hashing, and key management, plus blockchain security for EVM and Solana; ability to review smart contracts.
• - Able to take ambiguous security work or incidents from initial assessment through resolution with limited direction.
• - Clear communicator who can explain severity, likelihood, impact, and remediation tradeoffs to engineers, auditors, and security leaders.
• - An instinct for turning repeated findings into automated checks, controls, alerts, or lasting platform changes.

Nice to have

• - Experience commissioning or remediating third-party smart contract audits; familiarity with HSM or MPC custody and signing systems.
• - Cloud security experience with AWS or GCP, including IAM, containers, and runtime hardening.
• - Security monitoring or SIEM experience, relevant offensive security certifications, or work in regulated fintech, tokenization, or DeFi.