Security Engineer (Senior)

1. Fund Business Link Security and Risk Control

• Deeply participate in security architecture reviews of exchange/Web3 fund links, including key stages such as deposit confirmation, order state machine transitions, and withdrawal release.

• Identify and defend against logical vulnerabilities and risk control risks such as fake deposits, block reorganization/rollback, duplicate withdrawals, concurrency races, and amount precision anomalies.

• Build and optimize deposit/withdrawal reconciliation pipelines and hot/cold wallet balance verification mechanisms to achieve minute-level anomaly alerts and automated interception (limits, over-limit review, blacklisted addresses/high-frequency interception).

2. Wallet Key and Signing Service Security Architecture (including Relayer Security)

• Design and implement security solutions for hot wallet signing services, and drive the selection and implementation of hot/cold isolation, Multi-Sig, MPC threshold signatures, or HSM hardware hardening solutions.

• Responsible for the security architecture design of signing services and transaction forwarding/relaying (Relayer/Signer), implementing Nonce management, Replay Protection, signing permission control, and abnormal call rate limiting.

• Standardize key storage, call authentication, full signing audit, and key rotation processes, and implement strict Separation of Duties (SoD) and multi-level approval mechanisms for large withdrawals.

3. DevSecOps and Software Supply Chain Security

• CI/CD Security Gates: Build a DevSecOps system, seamlessly integrate SAST (static code analysis), SCA (software composition analysis/third-party dependency scanning), and Secret Scan (plaintext credential/key scanning) into CI/CD pipelines, and set up security checkpoints.

• Infrastructure Security: Responsible for security scanning and baseline compliance checks of Docker container images and IaC (such as Terraform/Ansible and other infrastructure-as-code) configurations.

4. Application, System, and Cloud Hardening

• Responsible for business backend authentication and privilege escalation protection, dual-person review of sensitive operations, and full audit log management.

• Drive public cloud (AWS / Alibaba Cloud) security hardening, including VPC isolation, IAM least privilege governance, bastion hosts and databases not exposed to the public internet, RPC node rate limiting, and DDoS defense.

5. Security Operations and Emergency Response

• Lead the analysis, loss containment, on-chain tracing, and post-incident hardening of security incidents (such as API abuse, abnormal withdrawals, phishing/impersonation, etc.), and consolidate emergency response plans.

• Regularly organize/coordinate external penetration testing and code audits, drive the closed-loop remediation of vulnerabilities; write automated inspection and on-chain monitoring scripts using Python/Go/Shell.
  

1. Core Experience

• Bachelor's degree or above from a regular full-time program (majors in computer science, electronics, cybersecurity, or related fields preferred).

• 5+ years of cybersecurity experience, including at least 3+ years of security experience in centralized exchanges (CEX) or Web3 fund-related businesses.

• Hands-on implementation experience in building an exchange security system or fund risk control system from 0 to 1.

2. Professional Technical Skills

• Fund and Transaction Security: Proficient in deposit/withdrawal logic, order state machine security, and deposit/withdrawal reconciliation; hands-on understanding of signing services and transaction forwarding mechanisms, Nonce management, replay attack defense, and signing permission verification.

• Wallets and Keys: Proficient in hot/cold wallet architecture, Multi-Sig/MPC/HSM principles, secure key storage, and permission isolation design.

• DevSecOps and Supply Chain: Familiar with SAST, SCA, credential scanning, and Docker/IaC scanning tools, with hands-on experience building security gates in CI/CD pipelines.

• Script Development and Cloud Security: Proficient in Python, Go, or Shell; familiar with AWS/Alibaba Cloud security systems, OWASP Top 10, Web/API penetration testing, and API anti-crawling and anti-abuse mechanisms.
  

3. Soft Skills and Bonus Points

• Language Ability: Good English reading and writing skills and cross-region/cross-time-zone team collaboration ability.

• Bonus Points: Ability to understand Solidity/EVM smart contract permission models (such as Owner, proxy upgrade, Pause, etc.) is preferred.

• Ability to work on-site is preferred