Security Engineer (Web3)

Location: On-site in Cayman, Denver, or New York; daily in-office work is required

Company

Product-focused engineering organization working across infrastructure, protocol, and platform security.

What you will do

• Own daily security operations, including monitoring, alerting, triage, incident investigation, and response.
• Manage endpoint security detections and incidents through an EDR platform.
• Lead identity lifecycle processes, including onboarding, offboarding, access provisioning, key rotation, and deprovisioning.
• Own the ImmuneFi bug bounty program, triage submissions, reproduce issues, and coordinate vulnerability remediation.
• Audit and harden CI/CD pipelines, dependency security, secrets management, supply-chain integrity, build provenance, and SAST/DAST integration.
• Review cloud environments and architectural changes, implement security tooling, and manage external security vendors.

Requirements

• 5–8+ years of experience in software and security engineering, including DevSecOps or security operations.
• Strong software engineering fundamentals and the ability to write production code.
• Hands-on experience hardening CI/CD pipelines such as GitHub Actions or CircleCI.
• Experience securing cloud infrastructure using AWS, GCP, or an equivalent platform.
• Proficiency with endpoint security tooling such as CrowdStrike or an equivalent EDR.
• Experience owning identity and access management workflows and communicating security risks to technical and non-technical stakeholders.

Nice to have

• Previous experience as a software engineer before specializing in security.
• Experience with a DeFi protocol, crypto exchange, or blockchain infrastructure company.
• CTF or security competition experience.
• Contributions to open-source security tooling.

Culture & Benefits

• Hands-on, builder-first security role embedded directly in the engineering organization.
• Close collaboration with infrastructure, protocol, and platform teams.
• Opportunity to shape security standards across the software development lifecycle.
• Responsibility for evaluating and onboarding security tooling as the threat landscape evolves.