Lead Security Engineer

Paxos Labs•New York, NY

1d•Onsite

About The Position

Paxos Labs builds enterprise infrastructure that powers the next generation of trusted onchain financial products. We work with the largest financial enterprises in the world to build transparent and verifiable onchain infrastructure that works for end users and everyday financial use cases. We believe security is critical to our culture and long term success. We are hiring a Lead Security Engineer to help take Paxos Labs's security capabilities to the next level. The engineering team at Paxos Labs deploys production software across the web2 and web3 stack, from smart contract protocols, DeFi integrations, and cloud infrastructure to public API/SDKs that requires a comprehensive security posture. We are looking for a motivated developer that can not only develop, but aptly research and deploy extensive knowledge across TradFi and DeFi to secure mission critical software.

Requirements

Deep knowledge of cloud infrastructure and web2 security practices.
Deep knowledge of cybersecurity standards and social engineering defenses.
Experience building full stack applications.
Deep Knowledge of the EVM security tooling, testing, and best practices
Deep knowledge of common hacks and exploits in DeFi protocols.
Deep knowledge of financial attack vectors in DeFi protocols.
Experience with CTFs, bugbounties, whitehat activities.

Responsibilities

Conduct internal audits of Cloud (Azure, AWS) platform security and implement best practices around key management, network security, monitoring, etc.
Create threat models for first party and third party software, research possible vulnerabilities and patch them.
Collaborate closely with infrastructure engineers to detect, fix, and prevent future exploits by creating resuable tools and processes.
Develop tooling and SOPs such as incident response manuals.
Conduct periodic incident response training for team members. Simulating hacks, alerts, and social engineering vectors.
Collaborate closely with both the technical and the non-technical staff to secure non-code related attack vectors and protect the weakest link i.e. the humans involved.
Collaborate closely with the Smart Contract team to conduct internal audits and to set up secure operational practices for the development and maintenance of smart contract protocols.
Build and deploy full stack tools for mitigating exploits and financial risks such as Detecting malicious transactions in the mempool and automating pauses across the smart contracts deployed on multiple chains.
Defining invariants and detecting violations in realtime.
Integrating third party security software where necessary.