Staff Security Engineer, Product

About the position: 

MoonPay is looking for a Staff Security Engineering Product to join our Technology and Security Services (TSS) Team, reporting to the CISO.   In this role, you will be responsible for playing a crucial role in ensuring the security and integrity of the products developed by MoonPay. This role will span various aspects of the product development lifecycle, from design to deployment, with the ultimate goal of identifying and mitigating security risks and vulnerabilities.   As a key member of the TSS team, you will work closely with engineering, design, IT, and other cross-functional teams to deliver best-in-class experiences for our users.

Key responsibilities:

Security Design and Architecture:

• Collaborate with product managers, engineers, and architects to integrate security requirements into the product design and architecture.
• Assess potential security risks and recommend appropriate security controls and mechanisms.
• Design and implement security features that protect the product and its users, such as authentication, authorization, encryption, and access controls.

Threat Modeling:

• Conduct threat modeling exercises to identify potential security threats and vulnerabilities in the product.
• Analyze potential attack vectors and prioritize them based on their impact and likelihood.

Code and Design Reviews:

• Participate in code reviews to identify and address security vulnerabilities, coding errors, and best practice violations.
• Review architecture designs to ensure alignment with security requirements and industry best practices.

Security Testing:

• Conduct security assessments such as penetration testing, vulnerability scanning, and code analysis to identify weaknesses and vulnerabilities.
• Collaborate with quality assurance teams to integrate security testing into the product development and testing processes.

Secure Development Practices:

• Advocate for and enforce secure coding practices across the engineering teams.
• Provide guidance and training to developers on secure coding techniques and best practices.

Incident Response and Bug Bounty Programs:

• Collaborate with incident response teams to handle and mitigate security incidents that affect the product.
• Manage bug bounty programs, working with external security researchers to identify and remediate vulnerabilities.

Security Documentation:

• Create and maintain security documentation, including threat models, security requirements, design documents, and security guidelines.

Compliance and Regulations:

• Ensure the product adheres to relevant security standards, compliance regulations, and industry certifications.

Security Awareness and Communication:

• Educate product teams about security risks and provide clear communication about security-related issues and solutions.

Cross-Functional Collaboration:

• Work closely with cross-functional teams, including engineering, product management, legal, and privacy, to align security efforts with overall business goals.

Security Training and Mentoring:

• Provide mentorship and guidance to peer security team members.

Skills & Experience:

Cryptocurrency and Blockchain Expertise:

• In-depth understanding of blockchain technology, including consensus mechanisms, cryptographic primitives, and decentralized protocols.
• Extensive knowledge and familiarity with various cryptocurrencies, smart contract platforms, and token standards (e.g., ERC-20, ERC-721).

Security Expertise:

• Profound knowledge of cryptography, including cryptographic algorithms, digital signatures, and secure key management.
• Strong understanding of blockchain security best practices, addressing vulnerabilities specific to smart contracts, token wallets, and blockchain nodes.

Smart Contract Security:

• Ability to conduct thorough audits of smart contracts to identify vulnerabilities, such as reentrancy, integer overflow, and logic errors.
• Familiarity with tools like Mythril, Slither, and Truffle for analyzing and testing smart contracts.

Decentralized Finance (DeFi) Understanding:

• Awareness of the intricacies of DeFi protocols, liquidity pools, yield farming, decentralized exchanges, and lending platforms.
• Ability to assess the security of DeFi applications and identify potential risks.

Privacy and Anonymity:

• Knowledge of privacy-focused cryptocurrencies and protocols.

Tokenomics and Economics:

• Understanding of token economics, token issuance, distribution mechanisms, and governance models within crypto projects.

Bonus qualifications: 

 Network and Protocol Security:

• Proficiency in assessing and securing blockchain network nodes, including node configuration, firewall settings, and consensus mechanisms.
• Understanding of Distributed Denial of Service (DDoS) mitigation strategies in the context of blockchain networks.

Security Tools and Frameworks:

• Familiarity with security tools specific to blockchain and crypto, such as blockchain explorers, security analysis tools, and vulnerability scanners.

Incident Response and Forensics:

• Experience in handling security incidents and conducting post-incident forensics in a blockchain environment.

Regulatory Compliance:

• Knowledge of legal and regulatory considerations in the crypto space, including Anti-Money Laundering (AML) and Know Your Customer (KYC) requirements.

Overall, the Staff Security Engineer, Product will serve as a bridge between security concerns and product development, ensuring that security is an integral part of the product lifecycle and that the final product meets the highest security standards. Given the rapidly changing nature of the cryptocurrency industry, the candidate should be well-versed in the latest developments, trends, and emerging threats specific to the crypto space. The candidate will play a critical role in ensuring the security and trustworthiness of crypto products and services.

Smart Contract Development:

• Ability to develop secure smart contracts
• Proficiency in writing code that follows best practices for minimizing vulnerabilities.

Logistics:

Our interview process usually takes place on Zoom and tends to consist of the following stages:

• Recruiter interview (~30 minutes)
• Initial interview (~30-45 minutes)
• Take home task (role dependent)
• Virtual onsite (2-3 30 minute interviews)
• Additional conversation (if applicable)

  Please let us know if you require any accommodations for the interview process, and we’ll do our best to provide assistance

  Research has shown that women are less likely than men to apply for this role if they do not have solid experience in 100% of these areas. Please know that this list is indicative and that we would still love to hear from you even if you feel you are only a 75% match. Skills can be learnt, diversity cannot.

  We promote a diverse and inclusive culture at MoonPay.

Listed in: Web3 Jobs, Remote Crypto Jobs, Non Tech Web3 Jobs, Research Crypto Jobs, Legal Web3 Jobs, Security Crypto Jobs, Developer Crypto Jobs, Engineering Crypto Jobs, Aml Web3 Jobs, Compliance Web3 Jobs, KYC Web3 Jobs, Recruiter Web3 Jobs, Quality Assurance Crypto Jobs, DeFi Web3 Jobs, Finance Crypto Jobs, Smart Contract Crypto Jobs, Contract Crypto Jobs, Cryptography Web3 Jobs, Full Time Web3 Jobs.