{"id":4231135,"url":"https://alion.io/job/startale-group-product-security-engineer","title":"Product Security Engineer","company":{"id":175340,"name":"Startale Group","domain":"startale.com","url":"https://alion.io/company/startale-group","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"C","score":58,"open_postings":13,"ghost_share":0.692,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":{"label":"UTC+9","utc_offset_min":9,"utc_offset_max":9},"hiring_geo_confidence":"inferred","locations":["Singapore"],"countries":["SG"],"hiring_countries":["JP","SG"],"hiring_countries_total":2,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"DeFi","optional":false},{"name":"JavaScript","optional":false},{"name":"Least Privilege","optional":false},{"name":"LLM","optional":false},{"name":"Rust","optional":false},{"name":"Solidity","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-04-13T13:05:01Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T09:51:46Z","board_verified":true,"closed_at":null,"days_open":213,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":213},"description":"About the role\nWe are seeking a hands-on Security Engineer who thrives in a startup environment.\nYou'll work alongside product owners and engineers with the objective to secure the products in Startale's ecosystem. Products include a next-generation decentralized exchange with a fully on-chain order book (Strium), a user-facing application (StartaleApp) and a stablecoin (USDSC). This is a hands-on, technical role. You'll be the person who actively tests our systems, hunts for vulnerabilities, models threats against our products, and works with engineers to close the gaps - not the person who writes policies and generates reports. You'll report to the Security Lead and collaborate daily with Backend, Frontend, DevOps, and Blockchain engineering teams.\nWhy this role\nStartale's products handle user funds and on-chain transactions so security work has tangible impact.\nOwning the security posture of a project at scale and complexity such as Strium is an opportunity for professional growth.\nYou will have direct influence over how product security is built across the organization.\nFocus is on driving product security and not on maintaining compliance documentation.\nOur team is backed by and partnering with leading Japanese enterprises so you will have a chance to work in a stable and well-funded company but with the autonomy and speed of a small team.\nKey responsibilities\nSecurity Assessments & Penetration Testing: Conduct hands-on security testing of our applications, APIs, and infrastructure. Simulate real attack scenarios against our products. Find the vulnerabilities before external attackers or whitehat researchers do. Work with engineers to fix issues pragmatically.\nThreat Modeling: Build threat models for new services and features - especially Strium's trading engine, order book, and transaction flows. Identify attack surfaces, model adversary behavior, and define what needs to be hardened before launch.\nVulnerability Triage & Remediation: Own the end-to-end lifecycle of findings - from discovery through severity assessment, developer-facing write-ups, remediation guidance, and verification of fixes. Coordinate with engineers so issues actually get closed.\nVulnerability Disclosure & Bug Bounty: Manage incoming whitehat reports, validate findings by reproducing them, assess severity, communicate with researchers.\n AI Tools Security Support: Assess technical risks related to AI tools used within teams (such as data exfiltration, prompt injection, training-on-input), maintain security baselines for AI coding tools and review AI-powered internal tools.\n\nQualifications\nMust-have\n5+ years of hands-on experience with a focus on application security, penetration testing, or product security.\nDemonstrated ability to find vulnerabilities - through manual testing, architecture and/or code review, or creative attack simulation. You should be able to describe specific bugs you've found and how you found them.\nPractical experience with exchange or trading platform security - from a DEX (preferred) or DeFi protocol. You should understand order book mechanics, transaction flows, wallet security, and the threat landscape specific to trading infrastructure.\nScripting and automation ability - you write tools and automate to scale security across the stack, not just audit and write reports.\nExperience triaging vulnerabilities and writing clear, actionable remediation guidance for developers.\nStrong written communication in English - you'll write tickets, assessment reports and researcher responses.\nStrong plus\nExperience with cloud infrastructure security - least-privilege enforcement, network security, secrets management.\nExperience with container security - network policies, RBAC, pod security standards, image scanning, Dockerfile hardening, base image management.\nAbility to read and review code in at least one of: TypeScript/JavaScript, Solidity, Rust.\nUnderstanding of software supply chain security, including dependency risks, build integrity, and methods for tracking what components are included in shipped software.\nExperience managing or participating in a bug bounty program (e.g. Immunefi, HackerOne).\nDomain plus\nExperience securing AI/LLM tooling in engineering teams - prompt injection risks, data leakage prevention, tool configuration hardening\nJapanese language ability (not required, but useful for company context)\n\nLocation / Timezone\nStrong preference for Tokyo-based or Singapore-based candidates - Startale office locations.\nRemote-friendly for exceptional candidates - must have 3+ hours overlap with Tokyo business hours (JST, UTC+9).\nTarget start date\nAs soon as available; realistic target start of Q3 2026.\nTarget companies\nDecentralized exchanges, DeFi protocols, blockchain security firms, L1/L2 chain security teams, or fintech companies with trading infrastructure. We're also open to strong AppSec engineers from cloud-native startups who have genuine interest in web3.\nIdeal candidate\nYou're a hands-on security engineer who finds real vulnerabilities, not just runs scanners. You've secured a trading platform or exchange and understand the threats specific to financial infrastructure - order book manipulation, transaction signing, wallet compromise, front-running. You can take a system, map the attack surface, and come back with findings that matter. You write clear reports that engineers act on, and you know the difference between a theoretical risk and a real one. You're comfortable working independently in a fast-moving team where there's no playbook - you write the playbook.","description_format":"text","description_chars":5576,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":[],"hiring_locations":[{"name":"Japan","iso":"JP","kind":"country"},{"name":"Singapore","iso":"SG","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Blockchain & Crypto","Cryptocurrencies","Crypto Exchanges","Stablecoins"],"lifecycle":[{"event":"open","at":"2026-11-13T09:51:46Z"}],"visa":[],"liveness":{"score":6,"band":"cold","label":"Long shot","p_open":1,"p_active":0.23,"p_room":0.28,"age_days":213,"expected_fill_days":35,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-11-13T11:56:12Z"},"pay":null,"html_url":"https://alion.io/job/startale-group-product-security-engineer","json_url":"https://alion.io/job/startale-group-product-security-engineer.json","meta":{"generated_at":"2026-11-13T11:56:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":24052,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":175340},"rest":"https://alion.io/mcp/rest/get_company?id=175340"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fstartale-group-product-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fstartale-group-product-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fstartale-group-product-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/startale-group-product-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fstartale-group-product-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4231135}},{"tool":"search_jobs","arguments":{"company":"startale.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4231135},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}