1 month ago
Responsibilities
- Lead application security reviews and threat modeling, including secure code review, architectural design, and testing.
- Develop automated security testing and mature the Secure SDLC.
- Own application security vulnerability management and coordinate penetration testing engagements.
- Develop application security best practices, provide code reviews and training, and foster security champions across engineering teams.
- Maintain the bug bounty program and bootstrap platform security initiatives that protect TRM data.
- Integrate security reviews and testing into product development and CI/CD workflows while prioritizing rapid threat assessments and vulnerability triage.
Requirements
- Minimum eight years of experience in software development and testing.
- Bachelor’s degree or equivalent in Computer Science, Computer Engineering, or a related field.
- Proficiency in Python, Node.js, and React.
- Strong understanding of encryption, authentication, authorization protocols, common software flaws, OWASP, CWE, and security testing methodologies.
- Professional experience with AWS and GCP security solutions, secure software development lifecycles, threat modeling, and security best practices.
- Experience conducting frequent code security reviews and triaging and remediating vulnerabilities in software packages or libraries.
- Experience with GitHub Advanced Security or other SAST, DAST, and SCA tools, as well as Burp Suite, OWASP ZAP, and OWASP Threat Dragon.
- Experience with red teaming or penetration testing of applications and infrastructure.
- Strong written and verbal communication skills.
- Security certifications such as OSCP, CEH, or GWAPT and familiarity with NIST SP 800-171 or SSDF are preferred.
Benefits
- Distributed-first work environment with hubs in Los Angeles, San Francisco, New York, Washington, D.C., London, and Singapore.
- Collaboration across Eastern, Pacific, and Central European time zones.
- Flexible, efficiency-focused team culture with opportunities for meaningful work on security, AI, and national security problems.
- Reasonable accommodations are available for applicants with disabilities.
About TRM Labs
TRM Labs builds AI-powered blockchain intelligence and investigation software for government agencies and financial institutions to detect, trace, and disrupt crypto‑related crime. Its platform supports AML, sanctions, fraud, and threat‑intelligence use cases, combining data analytics with tools for case building and transaction monitoring. Founded in 2018 and headquartered in San Francisco, the privately held company serves customers worldwide across public‑ and private‑sector markets.