Hong Kong
about 6 hours公司希望寻找熟悉：
Application Security / Product Security
API Security
钱包及交易系统安全
Secure SDLC、Code Review、Threat Modeling的资深安全工程师。
重点是保障产品和交易安全
We are seeking a hands-on Senior Product Security Engineer (Digital Assets) to improve the security of our applications, APIs, financial transaction workflows and digital asset-related systems.
This role works closely with software developers on secure architecture, security requirements, secure development practices and practical fixes. Relevant experience in transaction-sensitive platforms and an understanding of wallet, signing, key-management and authorization risks are important. The position does not require an expert in every blockchain protocol or a dedicated smart contract auditor.
• Conduct security design reviews and threat modeling for business applications, APIs, identity flows, financial transactions and wallet-related services.
• Work with developers to identify and remediate authentication, authorization, transaction integrity, replay, workflow bypass and security-sensitive business logic risks.
• Review wallet and fund-transfer security controls including signing workflows, key-management boundaries, administrative privileges, withdrawal authorization and multi-party approval mechanisms where applicable.
• Integrate application security into the SDLC through secure design, code review, SAST, SCA, secrets detection, vulnerability tracking, CI/CD security controls and security acceptance criteria.
• Evaluate risks in third-party software, open-source dependencies, APIs, wallet components and blockchain integrations; proactively follow relevant disclosures and remediation needs.
• Translate security findings into clear, prioritized engineering requirements, technical recommendations, testable acceptance criteria and validation activities.
• Review secure deployment and production change boundaries with DevOps and Security, including privileged service identities and protection against unauthorized modification of deployed application artifacts.
• Investigate application, wallet or transaction-related security incidents; assess attack paths, root causes, potential control failures and practical preventive measures.
• Support smart contract and blockchain security reviews when applicable, and coordinate external specialist assessment for complex cryptographic or protocol risks.
• Develop reusable secure engineering patterns, testing approaches and technical guidance that teams can adopt in real development workflows.
• Typically 5–8 years of relevant hands-on experience in application security, product security, security engineering or security-focused software development.
• Strong knowledge of application and API security, authentication, authorization, secure coding, common vulnerabilities and threat modeling.
• Practical experience reviewing software architecture or code and working directly with developers to implement and verify fixes.
• Experience with security-sensitive production transaction flows, such as payment systems, digital assets, wallets or comparable financial applications.
• Working understanding of wallet / signing / key-management risk, transaction authorization and separation of duties, or demonstrable hands-on experience in closely related financial transaction controls.
• Familiarity with SAST, SCA, secure SDLC practices, third-party dependency management and CI/CD security.
• Ability to analyze complex technical issues, collaborate across engineering functions and move security improvements through implementation to closure.
• Direct security engineering experience in a cryptocurrency exchange, digital asset wallet, custody platform or blockchain-based financial application.
• Experience with wallet architecture, hot/cold signing boundaries, withdrawal authorization, signing policy controls, MPC/HSM or cloud-based key-management services.
• Familiarity with Solidity/EVM, smart contract tooling and blockchain transaction analysis.
• Experience with Semgrep, CodeQL, Snyk, Slither, Foundry, fuzz testing, penetration testing or similar tools.
• Experience investigating production security incidents involving financial or digital asset transactions.
Security engineering that improves real products; understanding of transaction behavior and attack paths; direct collaboration with developers; strong technical judgment; practical, testable improvements rather than security checks alone.
