Security Architect – Crypto Wallet (f/m/d)

About the role

We are seeking a Security Architect to own security and privacy assurance for a self‑custody crypto wallet during its first delivery phase. You will work closely with mobile, backend, DevOps and QA teams, co‑sign milestone exit checklists and serve as the technical counterpart to the client’s independent auditor.

Key responsibilities

• Lead security and privacy assurance for the crypto wallet, ensuring continuous preventive measures.
• Collaborate daily with SDK integration, backend, mobile and DevOps engineers.
• Co‑sign exit checklists for each milestone and coordinate with external auditors.
• Define and enforce threat models, secure SDLC practices and supply‑chain security.
• Drive incident response, detection, triage and post‑mortem processes.

Required profile

• Strong written communication for auditors, counsel and non‑technical stakeholders (English C1).
• Deep experience in mobile and application security, applied cryptography, cloud and backend security.
• Hands‑on expertise with security tooling, reverse engineering and secure code review.
• Familiarity with compliance frameworks such as ISO/IEC 27001, SOC 2 and NIST CSF.

Required skills

• iOS Secure Enclave, Android Keystore/StrongBox, biometric APIs, platform attestation, RASP, anti‑tamper, certificate pinning.
• Mobile reverse engineering tools: Frida, Objection, MobSF.
• Cryptography: BIP‑32/39/44, ECDSA secp256k1, AES‑GCM, modern KDFs, envelope encryption, KMS/HSM, key rotation.
• AWS security services: IAM, KMS, VPC, CloudTrail, GuardDuty.
• OAuth 2.0, OIDC, JWT, JWKS, WebAuthn, session/device binding, API authorisation, rate limiting.
• Secure SDLC: threat modelling, secure code review, SAST, DAST, SCA, SBOM, secret scanning, CI/CD hardening.
• Digital‑asset security: EVM and Bitcoin transaction structures, ERC‑20, ERC‑4337, smart‑account wallets, address‑poisoning, drainer patterns, RPC provider trust assumptions.
• Compliance‑adjacent engineering: sanctions/address‑screening, KYC/CDD, Travel Rule data model, audit logging, data retention, US privacy requirements.
• Incident response: detection, severity triage, on‑call practice, post‑mortem discipline.

What we offer

• Opportunity to shape security for a cutting‑edge crypto wallet product.
• Collaborative, transparent culture with a focus on accountability.
• Work alongside experienced engineers across mobile, backend and DevOps.