DevOps Security Engineer

Legacy is an easy-to-use, non-custodial Web3 wallet designed to protect digital assets through beneficiary protection and seamless DeFi access. Users can swap across chains, earn yield in one click, and safeguard wealth for the next generation. Legacy is built by the team behind Decentralized Masters - a profitable $50M+ education and investment ecosystem with 4,000+ high-net-worth investors. Demand is strong and now you need someone to own the post-acquisition customer journey and turn users into long-term, high-LTV subscribers. You will be the single person responsible for the security of a platform that tracks hundreds of millions in digital assets. Your primary responsibilities are security and quality assurance. You need to break things for a living, look at attack vectors, catch vulnerabilities, and think about potential future attacks. You will own penetration testing, vulnerability assessments, threat modeling, automated test frameworks, and CI quality gates. Additionally, you will be responsible for infrastructure including AWS, CI/CD pipelines, monitoring, and incident response. The ideal candidate has experience at major product-driven fintech and crypto companies. What You Will Own Security (Primary) - Own the security posture across all products: Legacy, Trading Bot, and future platforms - Conduct regular penetration testing, vulnerability assessments, and threat modeling aligned with OWASP standards - Ensure full coverage of the OWASP Top 10 in application security testing - Perform security-focused code reviews across frontend, backend, and infrastructure code - Implement and manage secrets management, access controls, and least-privilege policies - Build and maintain incident response playbooks - Manage and coordinate external security audits and penetration tests Quality Assurance & Testing (Primary) - Design and implement test strategies across all products - Build and maintain automated testing frameworks and CI quality gates - Define and track quality metrics - Write and execute security test cases - Perform both white-box and black-box testing - Test across the full stack Infrastructure & DevOps (Foundation) - Maintain and improve cloud infrastructure on AWS - Own CI/CD pipelines - Harden infrastructure - Build logging, monitoring, and alerting - Ensure audit trails for user actions Fullstack Development (When the fortress is secure) - Contribute production code across frontend and backend - Build features, fix bugs, and ship improvements - Participate in architecture discussions and code reviews Requirements What You Bring Required - 5+ years in software engineering roles with hands-on security and QA experience - Fullstack development experience - Hands-on penetration testing and vulnerability assessment experience - Working knowledge of OWASP standards - Experience building automated test frameworks - AWS expertise - Infrastructure as Code experience - Container technologies experience - Scripting and automation proficiency - Experience with secrets management tools - Familiarity with security and testing tools - Strong communication skills Nice-to-Have - Security certifications - Experience at crypto, DeFi, Web3, or fintech product company - Familiarity with Web3-specific security concerns - SDET background - Experience testing financial systems - Experience implementing zero-trust architectures - Bug bounty participation Benefits What We Offer - Competitive salary + performance-based incentives - Direct exposure to founders - Team Offsites - Remote work - High ownership, high-impact role Legacy is an easy-to-use, non-custodial Web3 wallet designed to protect digital assets through beneficiary protection and seamless DeFi access. Users can swap across chains, earn yield in one click, and safeguard wealth for the next generation. Legacy is built by the team behind Decentralized Masters - a profitable $50M+ education and investment ecosystem with 4,000+ high-net-worth investors. Demand is strong and now you need someone to own the post-acquisition customer journey and turn users into long-term, high-LTV subscribers. You will be the single person responsible for the security of a platform that tracks hundreds of millions in digital assets. Your primary responsibilities are security and quality assurance. You need to break things for a living, look at attack vectors, catch vulnerabilities, and think about potential future attacks. You will own penetration testing, vulnerability assessments, threat modeling, automated test frameworks, and CI quality gates. Additionally, you will be responsible for infrastructure including AWS, CI/CD pipelines, monitoring, and incident response. The ideal candidate has experience at major product-driven fintech and crypto companies. What You Will Own Security (Primary) - Own the security posture across all products: Legacy, Trading Bot, and future platforms - Conduct regular penetration testing, v