Principal Security Engineer, Privy

Job description

Who we are About Privy Our mission is to make privacy and user ownership the default online. We build simple, flexible developer tooling that make it easy to build products that put users first. By leveraging modern cryptography, we shift the status quo around digital ownership and protect the accounts and assets of millions of users. Learn more about Privy: Privy and Stripe: Bringing crypto to everyone What you’ll do The Principal Security Engineer is a senior individual contributor responsible for defining, building, and operating security programs for high-risk financial technology and crypto infrastructure products, including embedded wallets, authentication systems, transaction flows, key management systems, developer platforms, and production cloud services. This role leads security architecture and hands-on technical security work across application security, product security, infrastructure security, incident response, vulnerability management, threat modeling, secure software development, and security automation. The Principal Security Engineer partners directly with engineering, product, infrastructure, compliance, legal, and executive stakeholders to identify and reduce systemic security risk across the company’s most sensitive products and services. The role requires deep expertise in modern software security, cloud-native systems, cryptographic protocols, wallet and blockchain threat models, secure authentication, web application security, vulnerability research, secure SDLC design, and practical incident response. The Principal Security Engineer is expected to operate independently on ambiguous, high-impact security problems; design scalable security controls; review complex architectures; identify exploitable vulnerabilities; build security tooling; guide engineering teams; and represent security judgment in critical product and platform decisions. Responsibilities Lead security architecture reviews for embedded wallet systems, authentication flows, key management infrastructure, transaction signing systems, crypto custody-adjacent services, and developer-facing APIs. Conduct advanced threat modeling for web, mobile, cloud, wallet, blockchain, and cryptographic systems. Identify, validate, prioritize, and drive remediation of vulnerabilities across applications, infrastructure, APIs, CI/CD pipelines, third-party integrations, and production services. Design and implement scalable security controls, automation, detection, alerting, and monitoring to reduce risk across engineering teams. Lead or support incident response, security investigations, root-cause analysis, containment, remediation, and post-incident hardening. Evaluate security implications of new product launches, infrastructure changes, vendor integrations, cryptographic designs, and authentication mechanisms. Develop security standards, secure engineering guidance, review processes, and technical documentation for engineering teams. Partner with engineering leadership to embed security into design, development, deployment, and operational workflows. Manage and triage external vulnerability reports, responsible disclosure submissions, penetration test findings, bug bounty reports, and third-party security assessments. Perform hands-on vulnerability research and proof-of-concept validation for complex application, protocol, authentication, authorization, cloud, and blockchain-related security issues. Mentor engineers and security team members on secure design, exploitability analysis, vulnerability remediation, and risk-based prioritization. Stay current on emerging threats affecting crypto infrastructure, fintech, cloud platforms, web application frameworks, supply- Who you are We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requireme