Full-Time Security Engineer

The Product Security Engineer at Chainalysis is dedicated to maintaining and enhancing the security of our products.. This role involves collaborating with developers to embed security into every stage of the product lifecycle, building custom security tools, automating assessments, and ensuring a robust security posture within our CI/CD pipelines. The Product Security Engineer also leads proactive efforts in vulnerability management, penetration testing, and security reviews to safeguard our products and continuously enhance our security practices

In this role, you’ll: 

• Conduct penetration testing and security assessments to identify vulnerabilities and ensure robust security measures.
• Develop and maintain custom security tools and scripts to automate and enhance security processes.
• Collaborate with development teams to integrate secure coding practices and solutions into both front-end and back-end systems.
• Review and improve security within CI/CD pipelines, integrating tools like SonarCloud and Wiz for continuous security assurance.
• Perform security audits and code reviews, offering guidance through pull requests and collaborative sessions.
• Analyze and address security issues by providing expert advice and actionable solutions to maintain the integrity of applications.

We’re looking for candidates who have: 

• Hands-on experience in penetration testing and security assessments, with a strong ability to identify and mitigate vulnerabilities.
• Excellent communication skills, both verbal and written, for effective collaboration with cross-functional teams.
• Proficiency with security tools like Burp Suite, Sonarcloud, Jfrog, and Wiz, and the capability to create custom scripts using Python to enhance automation.
• Proficient coding skills with a focus on security, particularly in Java and/or JavaScript. Alternative languages include Python and Go.
• Extensive knowledge of cloud security practices, specifically on platforms such as AWS and GCP.
• Experience integrating security tools into CI/CD pipelines, and a demonstrated ability to automate security testing within development workflows.

Nice to have experience:

• Familiarity with blockchain or cryptocurrency security challenges and solutions.
• Experience with Infrastructure as Code (IaC), particularly reviewing and securing Terraform code.
• Certifications such as CISSP, OSCP, or similar credentials, demonstrating a formalized knowledge of security principles and practices.

Technologies we use and teach:

• Coding Languages: Java, Python, and Javascript
• IaC: Terraform
• Cloud: AWS, GCP, Cloudflare
• CI/CD Pipeline: GitHub, GitHub Actions, Jenkins
• APIs: REST APIs