Core Responsibilities
Security Strategy Development
- Develop and maintain the company's overall security baseline, covering key areas such as production environments, office networks, key management, and access control.
- Regularly update policies in response to evolving threats, ensuring all departments operate under a unified framework.
Production Environment Security Audits
- Conduct regular reviews of production systems, including network architecture, IAM permissions, API security, and infrastructure configurations.
- Ensure the four-eyes principle and least privilege principle are effectively implemented across all projects.
Vulnerability Management & Penetration Testing
- Lead internal vulnerability discovery and classification.
- Coordinate or execute penetration testing.
- Track remediation progress to ensure closure within agreed SLAs, and report high-risk items directly to the CEO.
Key & Wallet Security
- For cryptocurrency exchange scenarios, establish security strategies for hot wallets and cold wallets, key rotation mechanisms, and multi-signature solutions.
- Ensure all asset-related operations have a complete auditable trail.
Security Incident Response (Technical)
- When security incidents occur, lead technical investigations, root-cause tracing, and forensic analysis.
- Produce independent technical investigation reports, collaborating with the Independent Risk Manager while maintaining separate conclusions.
Compliance Coordination
- Support KYC/AML compliance requirements and assist with regulatory audits.
- Drive implementation plans for relevant security certifications (such as ISO 27001 and SOC 2) based on business expansion needs.
Requirements
- 5+ years of experience in information security, including at least 2 years in fintech, crypto, payments, or trading platforms
- Preferable with CISSP, CISM, CEH, or equivalent certifications
- Hands-on cloud security experience (AWS / GCP / Azure), familiar with network segmentation, IAM, SIEM, and other core mechanisms
- Familiar with penetration testing methodologies, able to review and assess third-party penetration testing reports
- Capable of independently drafting security policies, not merely executing existing frameworks
- Practical experience in crypto assets, wallet security, or on-chain risk management
