Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 days ago

Senior Security Engineer - xStocks

kraken.com88 open roles

Where
Poland
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Security Engineer - xStockskraken.com · Poland

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on kraken.com's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.1% of postings close within 7 days. Measured by our own scanner across the market. kraken.com postings stay open a median of 12 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.1%7 days
  4. 19.1%14 days
  5. 35.6%30 days
  6. 52.7%60 days
This job: posted 8 days ago

kraken.com median: 12 days open

The posting

BUILDING THE FUTURE OF OPEN FINANCE

Payward - the parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks - has spent the last 15 years building one of the most modern and globally accessible financial infrastructure platforms in the industry, built to advance an open, global financial system.

THE TEAM

xStocks brings real-world assets on-chain as tokenized securities that are regulated, fully-backed, and tradable across multiple blockchains. Built within Payward, the xStocks team runs the infrastructure that issues, custodies, and settles these instruments across EVM, Solana, TON, Tron, and more. The platform moves real value, so security is not a feature bolted on at the end. It is a property of everything the team ships. This is a hybrid engineering and security seat built for someone who is genuinely both: you ship products alongside the engineering team when the security queue is quiet, and you own security work end to end when it lands. You report into engineering and partner closely with the Payward security, CISO, and compliance functions.

THE OPPORTUNITY

- Own security deliverables end to end. Coordinate and review smart-contract audits, respond to security questionnaires and due-diligence requests, support CISO and compliance initiatives, and turn findings into tracked, closed-out fixes.

- Run offensive assessments against our own platforms. Pentest the web apps, APIs, backend services, and on-chain components, and build the tooling to do it repeatedly rather than once.

- Continuously assess posture. Threat-model new and existing systems, review architecture and key-management flows, and maintain a living view of the risks and their mitigations.

- Review code for security. Be a default reviewer on changes touching auth, cryptography, custody, signing, and fund movement across our chains.

- Harden the platform. Improve secrets handling, IAM and least-privilege, dependency and supply-chain hygiene, and detection and logging for security-relevant events.

- Secure custody and signing workflows. Review and harden transaction signing flows, MPC and HSM integrations, signer permissions, admin roles, approval policies, and break-glass procedures.

- Contribute to product engineering. Pick up regular backlog work in TypeScript so you stay close to the codebase you are defending.

- Support incidents. Help with detection, triage, response, and post-mortems, and feed the lessons back into the program.

WHAT YOU BRING

- An engineer first. You write and review production code comfortably, TypeScript and Node.js in our stack, and you understand systems deeply enough to break them.

- Strong application and infrastructure security fundamentals. The OWASP-class vulnerability landscape, authn and authz, injection, SSRF, supply-chain risk, and secure design. You have done real offensive work in pentesting, vuln research, or red-team.

- Applied cryptography and blockchain security. Symmetric and asymmetric primitives, hashing, signatures, and key management, plus the security model of EVM, Solana, and ideally TON or Tron. You can read a smart contract and reason about how it fails.

- Ownership. You can take an ambiguous security item, an audit, a questionnaire, or an incident, and drive it to closure without being managed through it.

- Clear communication. You can explain a risk to engineers, to a CISO, and to an auditor, and tailor the message to each.

- An automation instinct. You do not want to catch the same issue manually twice, so you turn findings into tests, alerts, controls, documentation, or platform improvements.

- Risk judgment. You can tell a theoretical issue from a material one, and communicate severity, likelihood, impact, and remediation tradeoffs clearly.

NICE TO HAVE

- Experience commissioning or remediating third-party smart-contract audits.

- Familiarity with custody and signing infrastructure such as HSMs, MPC, and ForDefi-style providers, and with on-chain transaction security.

- Cloud security depth in GCP or AWS, IAM, and container and runtime hardening.

- Detection engineering and security observability, including SIEM and log-based detections.

- Relevant certifications such as OSCP, OSWE, or GWAPT.

- Prior work in a regulated fintech or tokenization/DeFi environment.

Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis.

Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution.

We consider qualified applicants with criminal histories for employment on our team, assessing candidates in a manner consistent with the requirements of the San Francisco Fair Chance Ordinance.

OUR COMMITMENT

Payward is powered by people from around the world and we celebrate the diverse talents, backgrounds, contributions, and unique perspectives that everyone brings to the table. We hire based on merit, seeking out people with the right abilities, knowledge, and skills for the job. We encourage you to apply for roles where you don't fully meet the listed requirements, especially if you're passionate or knowledgeable about crypto.

We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision.

As an equal opportunity employer, we don't tolerate discrimination or harassment of any kind, whether based on race, ethnicity, age, gender identity, citizenship, religion, sexual orientation, disability, pregnancy, veteran status, or any other protected characteristic as outlined by federal, state, or local laws.

Stay connected

Follow us on Twitter https://twitter.com/krakenfx

Learn on the Kraken Blog https://blog.kraken.com/#:~:text=Enter%20your%20email%20address

Connect on LinkedIn https://www.linkedin.com/company/kraken-exchange/

Candidate Privacy Notice https://www.kraken.com/legal/candidate-privacy-notice

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against kraken.com's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on kraken.com's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    kraken.com's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.