Product Security Engineer
About This Role
Startale's products handle user funds and on-chain transactions, so security work here has real impact. Owning the security posture of a project at the scale and complexity of Strium offers an opportunity for professional growth, with direct influence over how product security is built across the organization. The focus is on driving product security rather than maintaining compliance documentation. The team is backed by and partners with leading Japanese enterprises, offering the stability of a well-funded company combined with the autonomy and speed of a small team.
What You'll Be Doing
Conduct hands-on security assessments and penetration testing of applications, APIs, and infrastructure, simulating real attack scenarios to find vulnerabilities before external attackers or whitehat researchers do, and working with engineers to fix issues pragmatically.
Build threat models for new services and features, especially Strium's trading engine, order book, and transaction flows — identifying attack surfaces, modeling adversary behavior, and defining what needs to be hardened before launch.
Own vulnerability triage and remediation end-to-end, from discovery through severity assessment, developer-facing write-ups, remediation guidance, and verification of fixes, coordinating with engineers to ensure issues are actually closed.
Manage vulnerability disclosure and bug bounty activity, including validating and reproducing whitehat reports, assessing severity, and communicating with researchers.
Support AI tools security by assessing technical risks (such as data exfiltration, prompt injection, and training-on-input), maintaining security baselines for AI coding tools, and reviewing AI-powered internal tools.
What We're Looking For
5+ years of hands-on experience focused on application security, penetration testing, or product security.
A demonstrated ability to find vulnerabilities through manual testing, architecture or code review, or creative attack simulation, with specific examples of bugs found and how they were discovered.
Practical experience with exchange or trading platform security, from a DEX (preferred) or DeFi protocol, including understanding of order book mechanics, transaction flows, wallet security, and threats specific to trading infrastructure.
Scripting and automation ability to scale security work across the stack, not just audit and report.
Experience triaging vulnerabilities and writing clear, actionable remediation guidance for developers.
Strong written communication in English, for tickets, assessment reports, and researcher responses.
Bonus Points
Experience with cloud infrastructure security, including least-privilege enforcement, network security, and secrets management.
Experience with container security, including network policies, RBAC, pod security standards, image scanning, Dockerfile hardening, and base image management.
Ability to read and review code in at least one of TypeScript/JavaScript, Solidity, or Rust.
Understanding of software supply chain security, including dependency risks, build integrity, and tracking components in shipped software.
Experience managing or participating in a bug bounty program (e.g., Immunefi, HackerOne).
Experience securing AI/LLM tooling in engineering teams, including prompt injection risks, data leakage prevention, and tool configuration hardening.
Japanese language ability, useful for company context though not required.
About Startale Group
Startale Group is at the forefront of the Web3 revolution, building foundational infrastructure and innovative applications that empower a decentralized future. As a globally distributed team of blockchain specialists, we are committed to pushing the boundaries of what's possible in the crypto space. Our work spans critical areas such as scalable blockchain protocols, interoperability solutions, and developer tools designed to accelerate mass adoption. We believe in open-source principles and actively contribute to a more transparent and equitable digital world. Our culture is built on intellectual curiosity, collaborative growth, and a shared passion for decentralized technologies. We foster an environment where bold ideas are encouraged, and every team member has the opportunity to make a tangible impact. At Startale Group, you'll work alongside leading experts in zero-knowledge proofs, DeFi, NFTs, and DAO governance, tackling complex challenges with a startup mindset and a long-term vision. If you're a seasoned blockchain engineer, a product innovator with a Web3 focus, or a community builder eager to shape the next era of the internet, Startale Group offers an unparalleled opportunity. Join us to leverage cutting-edge technology, contribute to meaningful projects, and grow your career within a company that values innovation, autonomy, and impact. Be a part of the team defining the future of Web3.
Ready to Apply?
To submit your application for this position, please visit Startale Group's official website and follow their application process.