Product Security Engineer
Startale Group7 months ago
Remote, Japan +3 moreSenior
Responsibilities
- Conduct hands-on penetration testing and security assessments of applications, APIs, infrastructure, trading systems, and transaction flows.
- Build threat models for new services and features, including the trading engine, order book, and transaction flows.
- Own vulnerability discovery, severity assessment, developer-facing write-ups, remediation guidance, and verification of fixes.
- Manage vulnerability disclosure and bug bounty reports by reproducing findings, assessing severity, and communicating with researchers.
- Assess security risks in AI tools and internal AI-powered tools, including prompt injection, data exfiltration, and training-on-input risks.
- Collaborate with Backend, Frontend, DevOps, Blockchain, product, and engineering teams to improve product security.
Requirements
- 5+ years of hands-on experience focused on application security, penetration testing, or product security.
- Demonstrated ability to find vulnerabilities through manual testing, architecture or code review, or creative attack simulation.
- Practical experience securing an exchange or trading platform, preferably a DEX or DeFi protocol, including knowledge of order books, transaction flows, wallet security, and trading-infrastructure threats.
- Ability to write scripts and automation to scale security work across the stack.
- Experience triaging vulnerabilities and writing clear, actionable remediation guidance for developers.
- Strong written English communication skills for tickets, assessment reports, and researcher responses.
- Cloud infrastructure security experience, including least privilege, network security, and secrets management, is a strong plus.
- Container security experience with network policies, RBAC, pod security standards, image scanning, Dockerfile hardening, or base image management is a strong plus.
- Ability to read and review TypeScript/JavaScript, Solidity, or Rust is a strong plus.
- Understanding of software supply chain security is a strong plus.
- Bug bounty program experience, including Immunefi or HackerOne, is a strong plus.
- Experience securing AI/LLM tooling and Japanese language ability are additional advantages.
Benefits
- Tokyo- or Singapore-based candidates are strongly preferred, with remote work available for exceptional candidates.
- Remote candidates must have at least 3 hours of overlap with Tokyo business hours (JST, UTC+9).
- Target start is as soon as available, with a realistic target of Q3 2026.
- The role offers direct influence over product security at a stable, well-funded company backed by leading Japanese enterprises.
- The position provides autonomy and startup speed while working on products handling user funds and on-chain transactions.
Tech Stack
Categories
About Startale Group
Startale Group is a leading global web3 solutions provider on a mission to build the next civilization by bringing the world onchain. The company operates Astar Network, Japan’s largest public blockchain, and co-develops Soneium through Sony Block Solutions Labs, a joint venture with Sony Group Corporation. Beyond chain development, Startale also builds consumer and developer products such as the Startale App, which serves as an all-in-one gateway to the Soneium ecosystem and beyond, uniting blockchain-native applications in a single intuitive experience.