About Galoy

Galoy builds financial infrastructure on top of the Bitcoin network through open-source and Fair Source projects. Our products include Lana (Bitcoin-backed lending) and Bria (payments bridge), plus the Blink wallet.

Responsibilities

Threat Modeling — Lead threat-modeling sessions for new features, design mitigations, and champion security-by-design across the engineering organization
Code Review — Perform manual and automated security analysis of Rust codebases; conduct vulnerability hunting and responsible disclosure
Cloud Infrastructure — Harden GCP/Azure/Kubernetes deployments; manage IAM, network segmentation, and secrets management
DevSecOps — Integrate SAST/DAST, secret-scanning, and dependency checks into CI/CD pipelines
Incident Response — Maintain detection rules, triage security alerts, and conduct post-mortems
Research & Evangelism — Track emerging exploits and share findings with upstream open-source projects
Mentorship — Guide engineers on secure coding practices across the organization
Open-Source Contribution — Publish security enhancements to community repositories

Required Qualifications

5+ years application or cloud security experience with documented vulnerability discoveries
Rust fluency (or strong willingness to master it)
Bitcoin and Lightning protocol knowledge
Cloud-native expertise (AWS/GCP/Azure, Kubernetes, Terraform, CI/CD)
SAST/DAST, fuzzing, and CodeQL familiarity
Threat modeling and penetration testing capability
Strong written and verbal English communication
Proven ability to work in remote/async environments

Nice to Have

Spanish language proficiency
MPC wallet or custody model experience
Startup adaptability mindset

Benefits

Work on production-proven, Bitcoin-native technology
Contribute to open-source projects
Optional Bitcoin compensation
Remote-first, international team
Optional El Salvador relocation assistance with visa support

Interested in this role?

Send your CV and relevant security research to jobs@galoy.io

Apply Now