Cybersecurity Senior Engineer / Engineer

Core Responsibilities

Security Strategy Development

• Develop and maintain the company’s overall security baseline, covering key areas such as production environments, office networks, key management, and access control. 
• Regularly update policies in response to evolving threats, ensuring all departments operate under a unified framework.

Production Environment Security Audits

• Conduct regular reviews of production systems, including network architecture, IAM permissions, API security, and infrastructure configurations. 
• Ensure the four-eyes principle and least privilege principle are effectively implemented across all projects.

Vulnerability Management & Penetration Testing

• Lead internal vulnerability discovery and classification. 
• Coordinate or execute penetration testing. 
• Track remediation progress to ensure closure within agreed SLAs, and report high-risk items directly to the CEO.

Key & Wallet Security

• For cryptocurrency exchange scenarios, establish security strategies for hot wallets and cold wallets, key rotation mechanisms, and multi-signature solutions. 
• Ensure all asset-related operations have a complete auditable trail.

Security Incident Response (Technical)

• When security incidents occur, lead technical investigations, root-cause tracing, and forensic analysis. 
• Produce independent technical investigation reports, collaborating with the Independent Risk Manager while maintaining separate conclusions.

Compliance Coordination

• Support KYC/AML compliance requirements and assist with regulatory audits. 
• Drive implementation plans for relevant security certifications (such as ISO 27001 and SOC 2) based on business expansion needs.

Requirements

• 5+ years of experience in information security, including at least 2 years in fintech, crypto, payments, or trading platforms
• Preferable with CISSP, CISM, CEH, or equivalent certifications
• Hands-on cloud security experience (AWS / GCP / Azure), familiar with network segmentation, IAM, SIEM, and other core mechanisms
• Familiar with penetration testing methodologies, able to review and assess third-party penetration testing reports
• Capable of independently drafting security policies, not merely executing existing frameworks
• Practical experience in crypto assets, wallet security, or on-chain risk management