About the company
Blockchain is connecting the world to the future of finance. As the most trusted and fastest-growing global crypto company, it helps millions of people worldwide safely access cryptocurrency. Since 2011, Blockchain has earned the trust of over 90 million wallet holders and more than 40 million verified users.
Responsibilities
- Strategic Security Partnership: act as a senior security engineer for product lines like Consumer and OTC, owning security gates for major feature releases.
- Secure SDLC Operator: operate and improve the secure development lifecycle, including SAST/SCA/DAST, SARIF ingestion, PR review standards, CI/CD security automation, and vulnerability triage.
- AI-Driven SDLC Innovation: research, architect, and safely embed AI utilities and LLM agents into the secure development lifecycle.
- Threat Modelling & Architecture Reviews: lead STRIDE/attack-tree threat models for sensitive flows including authentication, payment, custody, reconciliation.
- Product Security Governance & Standards: translate technical risks and regulatory demands into clear security policies.
- Bug Bounty Leadership: oversee technical triage and remediation strategy for the Bug Bounty program.
- Release Reviews: perform deep-dive manual code reviews of security-sensitive Pull Requests.
- Advanced Code Auditing: conduct manual and automated code reviews on Java and Kotlin backend Pull Requests.
- Security Debt & Remediation Negotiation: produce data-driven Security Debt packs and negotiate remediation into engineering roadmaps.
- Detection & Telemetry Integration: define application runtime signals and work with SecOps to instrument logs and alerts.
- Testing & Automation: build and maintain product-level test harnesses, fuzzing/property tests and CI checks.
- Incident Response Support: provide product-level Incident Response expertise.
- Metrics & Risk Visibility: define and own Product Security metrics.
- People & Process: coach junior product security engineers and security champions.
Requirements
- 4+ years total security engineering experience with at least 3+ years focused on application/product security.
- Experience with Web, Mobile, Cloud, Infrastructure Pentests and Red Teaming.
- Proven track record of shipping security automation using CodeQL/GHAS, Snyk, or similar; familiar with SARIF ecosystem and ASPM workflows.
- Expert-level ability to audit and propose fixes in Kotlin/Java, TypeScript/JS, Python; familiarity with containerised deployments (Kubernetes).
- Strong threat modeling experience and pragmatic architecture guidance for high-stakes financial flows (AuthN/AuthZ, Cryptography, Payments).
- Experience building CI checks, test harnesses and lightweight fuzzing/property tests.
- Excellent stakeholder skills.
Conditions
- Position based in London.
- Nice-to-haves: fintech/Trading/OTC product security experience, AI-assisted security tooling, GRC frameworks, CVEs/security research, OSCP/OSWE/CISSP credentials.