Security Engineer (Platform & Corporate)

Security Engineer (Platform & Corporate) Hybrid, UAE | Reports to the General ManagerWe run a high-volume crypto platform. Real money moves through it every hour of every day, the user base is global, and the surface area is large — web and backend infrastructure, on-chain transaction flows, multi-sig treasuries, third-party integrations, and a team of people who are themselves targets. We're looking for one person to own security across all of it.You'll set the security guidelines the company works to, and you'll be the one enforcing them, not writing a policy that sits in a folder. That means access control across every system we run, screening for new hires and contractors, and deciding what a person actually needs versus what they'd like to have.What you'll actually doBuild and maintain the protection pipelines — CI/CD security gates, secrets management, dependency and supply chain checks, key management, hardware key policy, and incident response runbooks that are tested, not theoreticalMonitor live attack traffic, anomalous platform behaviour, wallet drains, phishing infrastructure spun up against our brand, and social engineering aimed at the team — including running your own phishing simulations and training, because a large share of real losses in this industry come through a person, not through codeReview our backend for both the holes and the waste — authentication, API authorisation logic, rate limiting, input validation, queue behaviour, database access, and our RPC/indexing layer. We want someone who finds the exposed internal endpoint and also notices a hot path making four calls where it needs oneOwn logging, alerting, and metrics that tell you something before users do, plus the discipline to chase an anomaly instead of restarting the service and moving onWork with our in-house legal team on how user data is collected, stored, accessed, retained, and protectedAudit our multi-sig structures and transaction flows — signer sets, thresholds, key custody, upgrade authorities, and the approval process behind them. If a single compromised laptop can move funds, we want to hear it from you firstWhat we need from youReal crypto experience — not adjacent, not curious. Fluent in DeFi mechanics, comfortable on-chain, able to read a transaction and trace funds without a walkthroughReal depth in application and infrastructure security — strong enough as an engineer to review production backend code and be taken seriously by the people who wrote it. Cloud, containers, network, and database security should all be familiar groundComfort carrying weight — when something breaks at 3am on a Sunday, you're the call, and the decision to recommend pausing the platform is yoursDirectness — if we're about to do something stupid, you tell us in plain language, early, and as often as it takesWe move fast and ship features without obvious precedents. Your job is to make that possible safely — not to become the reason nothing launches.