Cybersecurity Engineer

About the Role

At Uncharted Network, the blast radius of a security breach is measured in investor funds and platform trust — two things we are not willing to risk. As a Cybersecurity Engineer, you will threat-model the full attack surface: wallet custody and key management, exchange connectivity and API authentication, the investor portal, and the on-chain settlement layer. You will own our detection and response capability, harden our SOC 2 Type II posture, and serve as the firm's subject-matter expert on everything from application security to HSM configuration. We are looking for someone equally effective in an incident war room and in a pull-request review.

Responsibilities

• Conduct end-to-end threat modelling of Uncharted's platform: investor portal, wallet infrastructure, exchange API connectors, and on-chain components
• Design and implement application security controls including input validation, secret management, mTLS, and zero-trust networking policies
• Own the firm's HSM and key management architecture for custody and signing workflows
• Build and maintain detection and response tooling: SIEM rules, anomaly baselines, and incident playbooks
• Lead SOC 2 Type II readiness including control implementation, evidence collection, and auditor liaison
• Conduct vulnerability assessments, penetration testing, and security code reviews across the full stack

Requirements

• 5+ years of hands-on cybersecurity engineering experience, not solely in governance or advisory capacity
• Demonstrated application security skills: secure SDLC, OWASP Top 10, and web and API vulnerability classes
• Experience with HSM integration (Thales, AWS CloudHSM, or equivalent) and key lifecycle management
• Strong scripting ability in Python or a comparable language; comfortable managing infrastructure-as-code
• Familiarity with SOC 2 controls, cloud security posture management, and secrets management tooling (HashiCorp Vault, AWS Secrets Manager)
• Ability to model threats rigorously and communicate risk trade-offs clearly to engineers and leadership

Nice to Have

• On-chain security experience: smart contract vulnerability classes, front-running, MEV, and bridge exploit patterns
• Offensive security background (OSCP or equivalent) providing a practitioner's red-team perspective
• Experience securing WebSocket and FIX-protocol trading connections