Staff Security Engineer, Product

We are MoonPay. Architects of the future, inventors, artists, and authors of innovation.

Our vision? To unlock digital ownership for everyone. We are onboarding the world to web3, where people can own and control their digital identity, data, property, and money.

MoonPay is the world’s leading web3 infrastructure company. We provide end-to-end solutions for payments, enterprise-scale smart contract development, and digital asset management. Many of the world's most iconic brands rely on MoonPay to power their web3 strategies and ideas.

Now boarding the next generation of leaders. Come help us build what's next.

About the position: 

MoonPay is looking for a Staff Security Engineering Product to join our Technology and Security Services (TSS) Team, reporting to the CISO.   In this role, you will be responsible for playing a crucial role in ensuring the security and integrity of the products developed by MoonPay. This role will span various aspects of the product development lifecycle, from design to deployment, with the ultimate goal of identifying and mitigating security risks and vulnerabilities.   As a key member of the TSS team, you will work closely with engineering, design, IT, and other cross-functional teams to deliver best-in-class experiences for our users.

Key responsibilities:

Security Design and Architecture:

• Collaborate with product managers, engineers, and architects to integrate security requirements into the product design and architecture.
• Assess potential security risks and recommend appropriate security controls and mechanisms.
• Design and implement security features that protect the product and its users, such as authentication, authorization, encryption, and access controls.

Threat Modeling:

• Conduct threat modeling exercises to identify potential security threats and vulnerabilities in the product.
• Analyze potential attack vectors and prioritize them based on their impact and likelihood.

Code and Design Reviews:

• Participate in code reviews to identify and address security vulnerabilities, coding errors, and best practice violations.
• Review architecture designs to ensure alignment with security requirements and industry best practices.

Security Testing:

• Conduct security assessments such as penetration testing, vulnerability scanning, and code analysis to identify weaknesses and vulnerabilities.
• Collaborate with quality assurance teams to integrate security testing into the product development and testing processes.

Secure Development Practices:

• Advocate for and enforce secure coding practices across the engineering teams.
• Provide guidance and training to developers on secure coding techniques and best practices.

Incident Response and Bug Bounty Programs:

• Collaborate with incident response teams to handle and mitigate security incidents that affect the product.
• Manage bug bounty programs, working with external security researchers to identify and remediate vulnerabilities.

Security Documentation:

• Create and maintain security documentation, including threat models, security requirements, design documents, and security guidelines.

Compliance and Regulations:

• Ensure the product adheres to relevant security standards, compliance regulations, and industry certifications.

Security Awareness and Communication:

• Educate product teams about security risks and provide clear communication about security-related issues and solutions.

Cross-Functional Collaboration:

• Work closely with cross-functional teams, including engineering, product management, legal, and privacy, to align security efforts with overall business goals.

Security Training and Mentoring:

• Provide mentorship and guidance to peer security team members.

Skills & Experience:

Cryptocurrency and Blockchain Expertise:

• In-depth understanding of blockchain technology, including consensus mechanisms, cryptographic primitives, and decentralized protocols.
• Extensive knowledge and familiarity with various cryptocurrencies, smart contract platforms, and token standards (e.g., ERC-20, ERC-721).

Security Expertise:

• Profound knowledge of cryptography, including cryptographic algorithms