Security Engineer

Bastion provides regulated infrastructure for businesses to hold, move, and issue stablecoins through custodial wallets, payment orchestration, and stablecoin issuance. The Security Engineer will write production code and build security tooling, middleware, controls, detections, and compliance automation across cloud infrastructure, Kubernetes, product and application security, incident response, and GRC.

Responsibilities:

• Get hands-on with our Go codebase, AWS and Kubernetes environment, SIEM, and security services
• Contribute security feedback to at least one engineering design doc
• Ship your first security fix, guardrail, or detection to production
• Learn our incident response and on-call procedures, and join our security rotation
• Get up to speed on our DLP program and start contributing to its rollout
• Own at least one security domain end to end, such as Kubernetes and cloud hardening, application security in CI, or detection engineering
• Write and tune detections as code, add new telemetry sources, and reduce alert noise
• Ship your first reusable security library or middleware in Go (for example authorization, tenant isolation, request signing, or input validation) and get it adopted by at least one service team
• Be the security reviewer on design docs for new product features and architecture changes
• Deliver control automation and evidence for an active audit or regulatory workstream (SOC 1, SOC 2, OCC)
• Help launch and triage our bug bounty program, and grow our DLP coverage and policies
• Drive multi-quarter initiatives such as default-deny service-to-service networking, security policy evaluation, or just-in-time, granular access across more systems
• Expand our Kubernetes cluster and container security, including image scanning and signing, admission policies, pod security standards, and runtime protection
• Grow a shared set of security middleware and libraries that is adopted across the codebase, so the secure path is the easy path for our Go engineers
• Help expand our compliance scope with automation instead of spreadsheets
• Turn tabletop exercises and resilience testing into concrete fixes
• Join cross-functional planning and influence the security roadmap
• Building reusable security building blocks that make secure defaults easy across our platform
• Protecting the critical systems at the core of a regulated stablecoin platform
• Turning OCC and MiCA/DORA requirements into controls that are engineered, tested, and continuously evidenced
• Building high-signal detections across cloud, Kubernetes, identity, endpoint, and SaaS telemetry
• Hardening our Kubernetes clusters and container supply chain, from build to admission to runtime, without slowing deploys

Requirements:

• You'll help scale that program across security engineering, infrastructure, product and application security, detection and response, and the technical side of GRC (SOC 1, SOC 2, OCC, and MiCA/DORA)
• You must be able to write production code
• People who thrive here find ways to contribute in their first week and are fully productive by their third month. You need to be okay with that