Security Engineer, Institutional Trading

About the role

Blockchain is looking for a hands-on Security Engineer embedded in its Institutional Trading and Financial Operations (FinOps) team. The role focuses on the secure operation of off-chain trading processes and infrastructure handling significant capital: integrations, signing flows, key custody interfaces, middle-office workflows, order routing and settlement pipelines. It supports risk assessments, operating controls, anomaly detection and remediation, and does not require smart-contract auditing.

Key responsibilities

• Partner with Trading, Middle Office and Quant teams to map trading systems, data flows, third-party integrations and custody/settlement touchpoints.
• Map critical assets and workflows to find structural vulnerabilities, define the target state and draft Risk Treatment Plans aligned with standards such as CCSS, NIST and DORA.
• Act as security liaison for senior management and vendors, summarise technical gaps as business risks, evaluate vendors and manage security posture projects.
• Monitor FinOps security signals (abnormal orders, signature misuse, unusual settlements) and feed them into SIEM/SOAR for real-time response.
• Support secrets and key management hygiene, keeping keys in KMS/Vault, scoped to least privilege and rotated automatically.
• Help triage SAST/SCA findings for FinOps repositories, set up CI checks and remediation playbooks.
• Take part in incident exercises, post-incident reviews and remediation tracking, and document controls and risk summaries.
• Research, architect and safely embed AI utilities and LLM agents into the secure infrastructure.

Required profile

• 5+ years in security engineering, platform security or application security.
• Proven threat modeling expertise, including structured reviews such as STRIDE.
• Ability to turn technical debt into business risk for C-suite stakeholders.
• Experience raising, reading and auditing pull requests in at least one stack language (TypeScript, Java/Kotlin, Python).
• Nice to have: trading or financial operations background, blockchain exposure, SOC operations and SOC2/ISO 27001 familiarity, certifications.

Required skills

• Observability and detection tooling (SIEM, logs, metrics) and writing basic detection rules.
• KMS/HSM, secrets management (Vault, 1Password, AWS/GCP KMS), IAM and least privilege.
• Technical due diligence for third-party security integrations.

What we offer

• Unlimited vacation and unlimited books policy.
• Apple equipment and full-time salary based on experience with meaningful equity.
• Role based in the Paris office with four mandatory in-office days per week, plus up to 20 remote days per year.