Product Security Engineer

Skills

About the Role

You will be a hands-on security engineer securing products that handle user funds and on-chain transactions. You will actively test applications, APIs and infrastructure, build threat models for new services such as a trading engine and order book, own the lifecycle of vulnerability findings through remediation and verification, manage whitehat reports, and assess security risks of AI tools used internally.

Requirements

• 5+ years of hands-on experience in application security, penetration testing or product security
• Demonstrated ability to find vulnerabilities via manual testing, architecture or code review, or attack simulation
• Practical experience with exchange or trading platform security, preferably DEX or DeFi
• Scripting and automation ability
• Experience triaging vulnerabilities and writing actionable remediation guidance
• Strong written English communication
• Remote candidates must have 3+ hours overlap with Tokyo business hours (JST, UTC+9)

Responsibilities

• Conduct hands-on security testing and penetration testing of applications, APIs and infrastructure
• Simulate real attack scenarios and work with engineers to fix issues pragmatically
• Build threat models for new services and features, including trading engine, order book and transaction flows
• Own the vulnerability lifecycle from discovery through severity assessment, write-ups, remediation guidance and fix verification
• Manage incoming whitehat reports, reproduce findings, assess severity and communicate with researchers
• Assess technical risks of AI tools, maintain security baselines for AI coding tools and review AI-powered internal tools