Senior Security Application Engineer

BitGo (NYSE: BTGO) is the digital asset infrastructure company delivering custody, wallets, staking, trading, financing, stablecoins, and settlement services from regulated cold storage.

Since 2013, BitGo has focused on accelerating the transition of the financial system to a digital asset economy.

BitGo maintains a global presence and multiple regulated entities, including BitGo Bank & Trust, National Association, the first federally chartered digital asset trust bank owned by a publicly traded company.

Today, BitGo serves thousands of institutions, including many of the industry's top brands, financial institutions, exchanges, and platforms, and millions of investors worldwide.

For more information, visit www.bitgo.com.

This role will require being full-time onsite at our New York City office to support collaborative team dynamics and innovative problem-solving.

We are seeking a Senior Application Security Engineer to lead the technical execution of our product security strategy.

This role focuses on securing high-growth FinTech and Web3 digital asset platforms by building end-to-end security programs and integrating automated security controls directly into the software development lifecycle.

The ideal candidate has a deep engineering background, hands-on experience defending complex cloud environments, and a passion for securing blockchain-adjacent technologies.

• Lead comprehensive threat modeling and product security architecture reviews in collaboration with cross-functional teams.
• Integrate security automation into CI/CD pipelines utilizing SAST, DAST, and continuous vulnerability management tools.
• Architect and implement secure-by-default cloud infrastructure on AWS using Terraform and Kubernetes.
• Design and deploy robust encryption services, key management systems (KMS), and advanced data protection controls across distributed environments.
• Oversee operational security initiatives including corporate bug bounty programs, incident response workflows, and regular penetration testing engagements.
• Secure next-generation AI-integrated applications by establishing input/output validation protocols and LLM guardrails.
• Engineer proactive defenses to safeguard platform infrastructure against sophisticated adversaries and nation-state-level threats.