Senior Security Engineer

Role overview Bastion, a 40-person company providing regulated infrastructure for businesses to hold, move, and issue stablecoins (custodial wallets, global payment orchestration, and stablecoin issuance, delivered through its own regulated entities), is hiring a hands-on Senior Security Engineer as the second member of its security team. The engineer works alongside the Staff Security Engineer and reports to the CTO/CISO, helping scale a program that spans security engineering, infrastructure, product and application security, detection and response, and the technical side of GRC (SOC 1, SOC 2, OCC, and MiCA/DORA). The platform is almost entirely Go on Kubernetes (EKS) in AWS, managed with Terraform, and the security services are also written in Go; most of the time is spent writing production code, reviewing design docs, and building security tooling/middleware. Responsibilities Write production Go code, review design docs, and build security tooling and middleware that engineers can easily drop into any service Get hands-on with the Go codebase, AWS/Kubernetes (EKS) environment, SIEM, and existing security services, and ship a first security fix, guardrail, or detection to production within the first month Own at least one security domain end to end, such as Kubernetes and cloud hardening, application security in CI, or detection engineering Write and tune detections as code, add new telemetry sources, and reduce alert noise across cloud, Kubernetes, identity, endpoint, and SaaS telemetry Ship reusable security libraries or middleware in Go (for example authorization, tenant isolation, request signing, or input validation) and get them adopted by at least one service team Serve as security reviewer on design docs for new product features and architecture changes, and deliver control automation and evidence for active audit or regulatory workstreams (SOC 1, SOC 2, OCC, MiCA/DORA) Help launch and triage the bug bounty program and grow DLP coverage and policies Expand Kubernetes cluster and container security, including image scanning and signing, admission policies, pod security standards, and runtime protection Join the security on-call rotation and incident response procedures Qualifications Must be able to write production code; the platform and security services are written in Go Hands‑on practitioner willing to get into the codebase, AWS/Kubernetes environment, SIEM, and security services from week one Comfortable with the fast pace and changing specific work of a startup, and able to be fully productive by the third month Willing to participate in a security on‑call rotation Application conditions Remote within the US (US Remote); remote does not imply worldwide eligibility, so confirm residency, time zone, language, and work authorization on the original page Preference for candidates in New York City or open to relocating to NYC Requires joining the security on-call rotation Bastion participates in E-Verify to authorize eligibility of employment in the United States Bastion provides equal employment opportunities and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws Preferred qualifications Located in or willing to relocate to New York City Compensation and benefits Compensation Range: $180K - $250K (pay period not stated) No other benefits (equity/tokens, insurance, leave, or allowances) are specified in the listing #J-18808-Ljbffr