Security Researcher

About Galoy

Galoy is building the core banking system built for this moment:

• Architecture designed for efficient AI-assisted development, operations and customer experience.
• Ledger built to handle both fiat and digital assets natively.

The Galoy core equips de novo and established banks and credit unions to compete in a financial system transformed by digital assets and artificial intelligence. Its unified architecture is written in Rust and event-sourced throughout, giving banks a secure, replayable record of the past and the flexibility to adopt new technology.

Galoy’s open-source AI harness, Drua, connects AI agents to the core through MCP, with every agent scoped and every action logged. It is designed to serve three groups: developers building new products, staff managing daily operations, and customers served through LLM-based assistants.

Responsibilities

• Threat Modeling — Lead threat-modeling sessions for new features, design mitigations, and champion security-by-design across the engineering organization
• Code Review — Perform manual and automated security analysis of Rust codebases; conduct vulnerability hunting and responsible disclosure
• Cloud Infrastructure — Harden GCP/Azure/Kubernetes deployments; manage IAM, network segmentation, and secrets management
• DevSecOps — Integrate SAST/DAST, secret-scanning, and dependency checks into CI/CD pipelines
• Incident Response — Maintain detection rules, triage security alerts, and conduct post-mortems
• Research & Evangelism — Track emerging exploits and share findings with upstream open-source projects
• Mentorship — Guide engineers on secure coding practices across the organization
• Open-Source Contribution — Publish security enhancements to community repositories

Required Qualifications

• 5+ years application or cloud security experience with documented vulnerability discoveries
• Rust fluency (or strong willingness to master it)
• Bitcoin and Lightning protocol knowledge
• Cloud-native expertise (AWS/GCP/Azure, Kubernetes, Terraform, CI/CD)
• SAST/DAST, fuzzing, and CodeQL familiarity
• Threat modeling and penetration testing capability
• Strong written and verbal English communication
• Proven ability to work in remote/async environments

Nice to Have

• Spanish language proficiency
• MPC wallet or custody model experience
• Startup adaptability mindset

Benefits

• Work on bitcoin-native core banking technology
• Contribute to open-source projects
• Optional bitcoin compensation
• Remote-first, international team
• Optional El Salvador relocation assistance with visa support

Interested in this role?

Send your resume and relevant security research to jobs@galoy.io