Staff Software Engineer - Security

Working At Bitso

We are a diverse team that takes pride in understanding the perspectives of others. We fully embrace working remotely and we are eager to act, improve and accelerate progress inside and outside of our organization.

To drive revolutionary changes in society and make crypto useful, we delight our customers with world-class products, deep care, and intentional empathy.

Your Purpose 

As a Staff Software Engineer you will take ownership of critical technical decisions, collaborating with the team to implement enhancements and ensure the highest quality in our systems. You will play a pivotal role in defining and delivering cutting-edge technical solutions, guiding and mentoring other engineers, and setting the technical direction and architecture of our applications.

Your deep understanding on cyber security makes not only your team stronger but the whole Bitso.

Reports To

Engineering Manager

Who You Are 

• Passionate about cryptocurrency.
• Possesses a high degree of responsibility, organization, and discipline.
• Exhibits exceptional attention to detail.
• Demonstrates 5+ years of staff software engineering experience, including leadership experience, including managing and mentoring technical and product-oriented teams.
• Displays exceptional oral and written communication skills, and can convey complex security concepts to diverse audiences, including technical and non-technical stakeholders.
• Possesses excellent time and project management skills, with a proven ability to lead complex security initiatives and deliver results within set deadlines.
• You've got large experience working with Java 8+
• Strong hands-on experience developing high scalable system designs and building proposed solutions with teams;
• Strong understanding and experience working with distributed systems;
• Strong hands-on experience implementing multi-factor authentication (MFA) solutions, including biometrics, one-time passwords (OTP), WebAuthn, FIDO2, and risk-based authentication.
• Strong hands-on experience with secure coding principles and best practices, such as those outlined in the OWASP Top 10 and SANS CWE Top 25.
• Strong hands-on experience with API security best practices, including OWASP API Security Top 10, secure authentication (e.g., JWT), rate limiting, input validation, etc.
• In-depth knowledge of authentication and authorization mechanisms, including OAuth 2.0, OpenID Connect, SAML, and RBAC/ABAC models.
• Strong understanding of encryption standards, hashing algorithms and key management best practices for securing sensitive data.
• Proficiency in threat modeling methodologies (e.g., STRIDE, DREAD, PASTA) to systematically identify, analyze, and mitigate potential attack vectors.
• Experience working with application security testing tools, including SAST, DAST, and SCA tools to proactively detect and remediate vulnerabilities.
• Familiarity with SIEMs, logging, and monitoring tools (e.g., Splunk, ELK).
• Familiarity with offensive security methods such as red teaming, penetration testing and vulnerability assessments.
• Experience with observability and monitoring tools (e.g., Splunk, Datadog).
• Experience working with Git and automated CI/CD tools.
• Available to work full-time.
• Proficient in English.

Nice to Have

The following qualifications are not mandatory but would be valuable:

• You know your way around Kubernetes, GRPC, and REST
• You've got knowledge or experience in the finance industry
• SSDLC related certifications (e.g. OSWE, CSSLP, GWEB, CASP). 
• Familiarity with laws governing the privacy and security of personal data (e.g., GDPR, CCPA).

What You Will Do 

• Architect Security Solutions: Design and implement scalable and security, high-impact improvements to our product that support rapid growth and high visibility.
• Deliver High-Performance Code: Produce efficient, high-performance code that scales to meet the demands of hundreds of thousands of daily users.
• Stay Hands-On: Maintain active involvement in coding, partic