Principal Security Engineer, Privy

About Privy

What you’ll do

Responsibilities

• Lead security architecture reviews for embedded wallet systems, authentication flows, key management infrastructure, transaction signing systems, crypto custody-adjacent services, and developer-facing APIs.
• Conduct advanced threat modeling for web, mobile, cloud, wallet, blockchain, and cryptographic systems.
• Identify, validate, prioritize, and drive remediation of vulnerabilities across applications, infrastructure, APIs, CI/CD pipelines, third-party integrations, and production services.
• Design and implement scalable security controls, automation, detection, alerting, and monitoring to reduce risk across engineering teams.
• Lead or support incident response, security investigations, root-cause analysis, containment, remediation, and post-incident hardening.
• Evaluate security implications of new product launches, infrastructure changes, vendor integrations, cryptographic designs, and authentication mechanisms.
• Develop security standards, secure engineering guidance, review processes, and technical documentation for engineering teams.
• Partner with engineering leadership to embed security into design, development, deployment, and operational workflows.
• Manage and triage external vulnerability reports, responsible disclosure submissions, penetration test findings, bug bounty reports, and third-party security assessments.
• Perform hands-on vulnerability research and proof-of-concept validation for complex application, protocol, authentication, authorization, cloud, and blockchain-related security issues.
• Mentor engineers and security team members on secure design, exploitability analysis, vulnerability remediation, and risk-based prioritization.
• Stay current on emerging threats affecting crypto infrastructure, fintech, cloud platforms, web application frameworks, supply-

Who you are

Minimum requirements

• 10 years of professional experience in software security, application security, product security, infrastructure security, security engineering, vulnerability research, incident response, or closely related technical security roles.
• Experience must include substantial hands-on work securing production software systems, cloud infrastructure, web applications, APIs, authentication systems, or financial technology platforms.
• Bachelor’s degree in Computer Science, Computer Engineering, Information Systems, Information Security, Cybersecurity, Software Engineering, Electrical Engineering, Mathematics, or a closely related technical field. Foreign equivalent degrees are acceptable.
• Security architecture and threat modeling for complex software systems.
• Application security, including web application vulnerabilities, API security, authentication, authorization, session management, input validation, injection flaws, insecure deserialization, SSRF, XSS, CSRF, access control failures, and business logic vulnerabilities.
• Cloud and infrastructure security, including AWS or comparable cloud platforms, IAM, network security, secrets management, containerized workloads, CI/CD security, logging, monitoring, and production hardening.
• Secure software development practices and the ability to read, review, and reason about production code in modern programming languages such as JavaScript, TypeScript, Python, Go, Java, Ruby, Rust, or similar.
• Incident response, security investigations, vulnerability triage, exploitability assessment, remediation planning, and post-incident review.
• Cryptographic and authentication concepts, including public-key cryptography, digital signatures, key management, secure enclave or hardware-backed security models, OAuth/OIDC, passkeys/WebAuthn, wallet signing flows, and secure transaction approval patterns.
• Security tooling and automation, including SAST, DAST, dependency analysis, vulnerability scanners, custom detection tooling, logging pipelines, or security workflow automation.
• Risk-based prioritization of vulnerabilities and security findings in a production engineering environment.
• Communication with engineering, product, infrastructure, legal, compliance, and executive stakeholders on security risks and remediation tradeoffs.
• Ability to independently lead ambiguous, high-impact security initiatives across multiple teams.
• Ability to mentor engineers and influence secure design decisions without direct management authority.

Preferred qualifications

• Experience securing cryptocurrency, blockchain, wallet, custody, payment, financial technology, or high-value transaction systems.
• Experience with bug bounty programs, responsible disclosure, penetration testing, red-team findings, or vulnerability research.
• Experience reviewing cryptographic protocols, transaction signing systems, embedded wallets, smart-contract-adjacent systems, or developer SDKs.
• Experience building internal security platforms, security automation, detection systems, or developer-facing security tools.
• Public contributions to the security community, such as conference presentations, publications, open-source tools, vulnerability disclosures, CVEs, security research, or peer review of security work.