Principal Security Engineer, Privy

Our mission is to make privacy and user ownership the default online. We build simple, flexible developer tooling that make it easy to build products that put users first. By leveraging modern cryptography, we shift the status quo around digital ownership and protect the accounts and assets of millions of users.

Learn more about Privy: Privy and Stripe: Bringing crypto to everyone

The Principal Security Engineer is a senior individual contributor responsible for defining, building, and operating security programs for high-risk financial technology and crypto infrastructure products, including embedded wallets, authentication systems, transaction flows, key management systems, developer platforms, and production cloud services.

This role leads security architecture and hands-on technical security work across application security, product security, infrastructure security, incident response, vulnerability management, threat modeling, secure software development, and security automation. The Principal Security Engineer partners directly with engineering, product, infrastructure, compliance, legal, and executive stakeholders to identify and reduce systemic security risk across the company’s most sensitive products and services.

The role requires deep expertise in modern software security, cloud-native systems, cryptographic protocols, wallet and blockchain threat models, secure authentication, web application security, vulnerability research, secure SDLC design, and practical incident response. The Principal Security Engineer is expected to operate independently on ambiguous, high-impact security problems; design scalable security controls; review complex architectures; identify exploitable vulnerabilities; build security tooling; guide engineering teams; and represent security judgment in critical product and platform decisions.

• →Lead security architecture reviews for embedded wallet systems, authentication flows, key management infrastructure, transaction signing systems, crypto custody-adjacent services, and developer-facing APIs.
• →Conduct advanced threat modeling for web, mobile, cloud, wallet, blockchain, and cryptographic systems.
• →Identify, validate, prioritize, and drive remediation of vulnerabilities across applications, infrastructure, APIs, CI/CD pipelines, third-party integrations, and production services.
• →Design and implement scalable security controls, automation, detection, alerting, and monitoring to reduce risk across engineering teams.
• →Lead or support incident response, security investigations, root-cause analysis, containment, remediation, and post-incident hardening.
• →Evaluate security implications of new product launches, infrastructure changes, vendor integrations, cryptographic designs, and authentication mechanisms.
• →Develop security standards, secure engineering guidance, review processes, and technical documentation for engineering teams.
• →Partner with engineering leadership to embed security into design, development, deployment, and operational workflows.
• →Manage and triage external vulnerability reports, responsible disclosure submissions, penetration test findings, bug bounty reports, and third-party security assessments.
• →Perform hands-on vulnerability research and proof-of-concept validation for complex application, protocol, authentication, authorization, cloud, and blockchain-related security issues.
• →Mentor engineers and security team members on secure design, exploitability analysis, vulnerability remediation, and risk-based prioritization.
• →Stay current on emerging threats affecting crypto infrastructure, fintech, cloud platforms, web application frameworks, supply-

We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement.

• 10 years of professional experience in software security, application security, product security, infrastructure security, security engineering, vulnerability research, incident response, or closely related technical security roles.
• Experience must include substantial hands-on work securing production software systems, cloud infrastructure, web applications, APIs, authentication systems, or financial technology platforms.
• Bachelor’s degree in Computer Science, Computer Engineering, Information Systems, Information Security, Cybersecurity, Software Engineering, Electrical Engineering, Mathematics, or a closely related technical field. Foreign equivalent degrees are acceptable.
• Security architecture and threat modeling for complex software systems.
• Application security, including web application vulnerabilities, API security, authentication, authorization, session management, input validation, injection flaws, insecure deserialization, SSRF, XSS, CSRF, access control failures, and business logic vulnerabilities.
• Cloud and infrastructure security, including AWS or comparable cloud platforms, IAM, network security, secrets management, containerized workloads, CI/CD security, logging, monitoring, and production hardening.
• Secure software development practices and the ability to read, review, and reason about production code in modern programming languages such as JavaScript, TypeScript, Python, Go, Java, Ruby, Rust, or similar.
• Incident response, security investigations, vulnerability triage, exploitability assessment, remediation planning, and post-incident review.
• Cryptographic and authentication concepts, including public-key cryptography, digital signatures, key management, secure enclave or hardware-backed security models, OAuth/OIDC, passkeys/WebAuthn, wallet signing flows, and secure transaction approval patterns.
• Security tooling and automation, including SAST, DAST, dependency analysis, vulnerability scanners, custom detection tooling, logging pipelines, or security workflow automation.
• Risk-based prioritization of vulnerabilities and security findings in a production engineering environment.
• Communication with engineering, product, infrastructure, legal, compliance, and executive stakeholders on security risks and remediation tradeoffs.
• Ability to independently lead ambiguous, high-impact security initiatives across multiple teams.
• Ability to mentor engineers and influence secure design decisions without direct management authority.
•  

• Experience securing cryptocurrency, blockchain, wallet, custody, payment, financial technology, or high-value transaction systems.
• Experience with bug bounty programs, responsible disclosure, penetration testing, red-team findings, or vulnerability research.
• Experience reviewing cryptographic protocols, transaction signing systems, embedded wallets, smart-contract-adjacent systems, or developer SDKs.
• Experience building internal security platforms, security automation, detection systems, or developer-facing security tools.
• Public contributions to the security community, such as conference presentations, publications, open-source tools, vulnerability disclosures, CVEs, security research, or peer review of security work.