Paxos is looking for an Application Security Engineer to become a key guardian of our financial and blockchain ecosystem. You will ensure that the code we ship and run is secure by design. At Paxos, we are on a mission to open the world’s financial system to everyone by enabling the instant movement of any asset, any time, in a trustworthy way.
What You'll Do
- Perform deep-dive security reviews of web applications, APIs, and cloud infrastructure.
- Develop security-focused tools and libraries in Go, Java, or Ruby to assist developers in writing secure code.
- Support our blockchain initiatives by identifying risks in L1/L2 integrations and smart contract interactions.
- Manage and tune Web Application Firewalls (WAF) and cloud-native security controls.
- Contribute to the security culture through developer training and participating in incident response when necessary.
- Build and maintain the tooling that integrates security into our development lifecycle, moving from manual reviews to automated, scalable guardrails.
- Partner with engineering teams during the design phase of new features (Threat Modeling) to identify risks before a single line of code is written.
- Manage the end-to-end lifecycle of vulnerabilities, from discovery via internal audits or Bug Bounties to collaborating with engineers on 'gold-standard' remediations.
What We're Looking For
- Proven ability to perform deep-dive manual security testing while also securing production-quality code.
- Expert-level knowledge of OWASP Top 10, CWE, and API security vulnerabilities.
- Experience building and scaling security checks directly into CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins).
- Working knowledge of AWS/GCP security configurations, particularly IAM, VPCs, and WAF management.
Nice to Have
- Proficiency in Go, Java, or Ruby.
Technical Stack
- Languages: Go, Java, Ruby
- Cloud: AWS, GCP
Team & Environment
The Security team is a specialized, deeply technical, and vigilant group tasked with protecting our digital assets, customer funds, and sensitive data against a sophisticated threat landscape.
