Security & Infrastructure Engineer (DevSecOps, Web3)

Security & Infrastructure Engineer (DevSecOps, Web3)

About us:

Vaultody is a cutting-edge technology solution that enables companies and institutions to securely store and operate with their digital assets. Vaultody is an MPC (Multi-Party Computation) digital asset infrastructure.

The largest crypto losses of the last two years did not come from broken cryptography. They came from a compromised laptop, a deploy pipeline with too much reach, or a signing service that signed whatever it was handed. We are looking for the person who makes sure that can never happen at Vaultody.

This is a single-owner seat. You own our infrastructure and its security end to end: the Kubernetes clusters and service mesh, the CI/CD pipeline and who can ship to production, the services that ask our MPC nodes for signatures, the smart contracts we deploy, and the laptops and accounts of everyone on the team. You set the rules, you enforce them in code and configuration rather than in documents, and you watch production so that when something unusual happens, you know first.

The ideal candidate is a DevOps or platform engineer who became a security engineer, or the other way round, who can read and fix application code, not only configure tools, and who understands how wallets, signatures and EVM transactions actually work. We are AI-native: you will use agents like Claude Code to audit code, write policies and automate checks at a pace a traditional security team cannot match.

Key Responsibilities:

• Own our cloud and Kubernetes infrastructure (GCP / GKE, Istio, ArgoCD, Terraform): availability, hardening, cost and change control

• Design and enforce the path to production: branch protection, required reviews, CODEOWNERS, environment approvals, isolated deploy runners and short-lived credentials (OIDC / Workload Identity) instead of static keys

• Secure the signing path: service-to-service authorization and mTLS, least-privilege access to MPC and signer services, and checks that every signature corresponds to a real, approved transaction

• Review and harden the code of security-critical services (Node.js and Go) yourself, and work with the backend team on fixes

• Review and test our smart contracts (Solidity / Foundry), including EIP-7702 delegation and gas sponsorship; manage deployer keys and verify deployed bytecode

• Build monitoring and detection: on-chain checks such as unexpected delegations or approvals, anomalous signing activity, audit-log alerts into a SIEM, and an on-call runbook for incidents

• Manage endpoint security for the team: device management (MDM), disk encryption, hardware security keys, extension and package allowlists, and safe handling of untrusted code (including candidate test assignments)

• Run access reviews across GitHub, Google Workspace, GCP and production systems, and remove what is not needed

• Own secrets and key management: rotation, vaulting, backup and recovery procedures

• Drive our compliance evidence for SOC 2 and ISO 27001 from real controls, and support external audits and penetration tests

• Lead incident response and blameless post-mortems, and turn every finding into a control that stops it from coming back

Essential Skills:

• Several years in DevOps, platform, SRE or security engineering, with production ownership of Kubernetes on a major cloud (GCP preferred)

• Hands-on with Kubernetes, Docker, Helm, ArgoCD, Terraform and GitHub Actions, including self-hosted runners

• Service mesh and network security: Istio (AuthorizationPolicy, PeerAuthentication / mTLS), NetworkPolicies, zero-trust access

• Able to read, review and fix application code in at least one of Node.js / TypeScript or Go

• Solid understanding of applied cryptography and key management: ECDSA / EdDSA signatures, HSM / KMS, secrets management

• Working knowledge of blockchain transactions on EVM chains: signing, nonces, approvals and permits, and contract calls

• Experience with identity and access management at company level: SSO, MFA / hardware keys, least privilege, access reviews

• Experience with monitoring and alerting (Prometheus, Grafana, Loki or similar) and running incident response

• Experience with AI development tools and an AI-driven way of working

• Strong analytical thinking and the confidence to say no to an unsafe change

• Good command of English, both spoken and written

Desirable Skills:

• Experience at a custody provider, exchange, wallet or other company holding digital assets

• Smart contract security: Solidity, Foundry, common vulnerability classes, audit experience

• Knowledge of EIP-7702, ERC-4337, EIP-712 typed data, Permit / Permit2 and how they are abused

• Experience with MPC / threshold signatures (DKLS, FROST, GG18/20) or HSM-based signing

• Endpoint management (Jamf, Kandji, Intune or similar) for a macOS-heavy team

• SOC 2, ISO 27001, DORA or MiCA compliance work

• Supply-chain security: dependency scanning, SBOMs, signed builds, npm ecosystem threats

• Familiarity with the techniques of state-sponsored crypto attackers (fake job interviews, malicious packages, poisoned IDE extensions)

• Security certifications such as OSCP, CKS or similar are a plus

What We Offer:

• Real authority: you set the security standard for the whole company and have the founder's backing to enforce it

• A platform where your work protects real assets every day, not a checklist

• A team and leadership that genuinely want automation to win, with AI agents doing the volume while you set the rules

• Competitive salary

• ESOP Program

• Multisport card

• Additional Health Insurance

• Massages in the office

• Birthday Gift

• Additional Paid Vacation

• Flexible working hours

• A dynamic, international team with friendly, highly qualified colleagues

• Continuous growth, fresh challenges, and a culture that values work-life balance

• Cozy office, with an excellent location

If you are interested in this challenge, please send us your resume, expected salary, and the date of your availability.

Only shortlisted candidates will be contacted. All applications will be treated with strict confidentiality.