Principal Security Engineer, Privy

Stripe is a technology company that aims to make privacy and user ownership the default online through its Privy division. The Principal Security Engineer will define and operate security programs for fintech and crypto infrastructure, leading security architecture and hands-on technical security work across various domains.

Responsibilities:

• Lead security architecture reviews for embedded wallet systems, authentication flows, key management infrastructure, transaction signing systems, crypto custody-adjacent services, and developer-facing APIs
• Conduct advanced threat modeling for web, mobile, cloud, wallet, blockchain, and cryptographic systems
• Identify, validate, prioritize, and drive remediation of vulnerabilities across applications, infrastructure, APIs, CI/CD pipelines, third-party integrations, and production services
• Design and implement scalable security controls, automation, detection, alerting, and monitoring to reduce risk across engineering teams
• Lead or support incident response, security investigations, root-cause analysis, containment, remediation, and post-incident hardening
• Evaluate security implications of new product launches, infrastructure changes, vendor integrations, cryptographic designs, and authentication mechanisms
• Develop security standards, secure engineering guidance, review processes, and technical documentation for engineering teams
• Partner with engineering leadership to embed security into design, development, deployment, and operational workflows
• Manage and triage external vulnerability reports, responsible disclosure submissions, penetration test findings, bug bounty reports, and third-party security assessments
• Perform hands-on vulnerability research and proof-of-concept validation for complex application, protocol, authentication, authorization, cloud, and blockchain-related security issues
• Mentor engineers and security team members on secure design, exploitability analysis, vulnerability remediation, and risk-based prioritization
• Stay current on emerging threats affecting crypto infrastructure, fintech, cloud platforms, web application frameworks, supply-

Requirements:

• 10 years of professional experience in software security, application security, product security, infrastructure security, security engineering, vulnerability research, incident response, or closely related technical security roles
• Experience must include substantial hands-on work securing production software systems, cloud infrastructure, web applications, APIs, authentication systems, or financial technology platforms
• Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Information Security, Cybersecurity, Software Engineering, Electrical Engineering, Mathematics, or a closely related technical field. Foreign equivalent degrees are acceptable
• Security architecture and threat modeling for complex software systems
• Application security, including web application vulnerabilities, API security, authentication, authorization, session management, input validation, injection flaws, insecure deserialization, SSRF, XSS, CSRF, access control failures, and business logic vulnerabilities
• Cloud and infrastructure security, including AWS or comparable cloud platforms, IAM, network security, secrets management, containerized workloads, CI/CD security, logging, monitoring, and production hardening
• Secure software development practices and the ability to read, review, and reason about production code in modern programming languages such as JavaScript, TypeScript, Python, Go, Java, Ruby, Rust, or similar
• Incident response, security investigations, vulnerability triage, exploitability assessment, remediation planning, and post-incident review
• Cryptographic and authentication concepts, including public-key cryptography, digital signatures, key management, secure enclave or hardware-backed security models, OAuth/OIDC, passkeys/WebAuthn, wallet signing flows, and secure transaction approval patterns
• Security tooling and automation, including SAST, DAST, dependency analysis, vulnerability scanners, custom detection tooling, logging pipelines, or security workflow automation
• Risk-based prioritization of vulnerabilities and security findings in a production engineering environment
• Communication with engineering, product, infrastructure, legal, compliance, and executive stakeholders on security risks and remediation tradeoffs
• Ability to independently lead ambiguous, high-impact security initiatives across multiple teams
• Ability to mentor engineers and influence secure design decisions without direct management authority
• Experience securing cryptocurrency, blockchain, wallet, custody, payment, financial technology, or high-value transaction systems
• Experience with bug bounty programs, responsible disclosure, penetration testing, red-team findings, or vulnerability research
• Experience reviewing cryptographic protocols, transaction signing systems, embedded wallets, smart-contract-adjacent systems, or developer SDKs
• Experience building internal security platforms, security automation, detection systems, or developer-facing security tools
• Public contributions to the security community, such as conference presentations, publications, open-source tools, vulnerability disclosures, CVEs, security research, or peer review of security work