Bitcoin Security Engineer - Strategy

Responsibilities

• Bitcoin & Wallet Penetration Testing: Plan and execute hands-on penetration tests against Strategy's bitcoin wallet architectures, including single-sig, multisignature, MPC, and hardware-wallet deployments, targeting key generation, storage, backup, and recovery workflows for exploitable weaknesses.
• Signing Ceremony & Custody Red-Teaming: Design and run adversarial simulations of signing ceremonies, quorum policies, and transaction-approval workflows, testing for insider-threat, social-engineering, collusion, and operational-security failure modes across cold, warm, and hot storage tiers.
• Hardware & Cryptographic Testing: Perform security testing of hardware wallets, HSMs, secure elements, and air-gapped devices, including firmware analysis, fault-injection and side-channel research, entropy and RNG validation, and supply-chain tamper assessment.
• Protocol, Node & Transaction-Layer Testing: Test Bitcoin node, RPC, and transaction-construction surfaces, including PSBT handling, fee and RBF logic, transaction malleability, address-generation and derivation-path validation, and P2P/mempool-facing attack surfaces.
• Blockchain Application Security: Assess the security of blockchain-adjacent infrastructure Strategy relies on, including smart contracts, tokenization platforms, bridges, oracles, and on-chain settlement logic, for vulnerabilities and abuse conditions.
• Elevated Custodian Security Research & Analysis: Lead deep offensive and analytical research into the security posture of Strategy's custodians and prospective custodians, including qualified custodians, exchanges, and asset servicers, pressure-testing their key-management, segregation, access-control, and recovery claims through structured technical due diligence and adversarial threat modeling.
• Threat Modeling & Attack Surface Mapping: Build and maintain comprehensive threat models and attack-surface inventories for Strategy's end-to-end bitcoin custody chain, prioritizing findings by realistic adversary capability and financial impact.
• Findings, Reporting & Remediation Support: Produce clear, reproducible penetration-test reports with proof-of-concept exploits, severity ratings, and pragmatic remediation guidance, and partner with engineering and custody teams to validate fixes through retesting.
• Security Research & Community Engagement: Conduct original research into emerging bitcoin, cryptography, and blockchain vulnerabilities; responsibly disclose findings; and represent Strategy within the global bitcoin security community, including exchanges, custodians, service providers, and core developers.
• Tooling & Automation: Develop custom tooling, harnesses, fuzzers, and test automation to make bitcoin and custody security testing repeatable, scalable, and continuous.

Qualifications

• Advanced Technical Education: Bachelor's degree required in Computer Science, Cryptography, Information Security, Engineering, or a related field; Master's Degree in a relevant discipline strongly preferred. Equivalent demonstrable offensive-security experience will be considered.
• Offensive Security Experience: 6+ years of hands-on penetration testing, red-team, vulnerability research, or exploit-development experience, with a substantial portion focused on cryptographic systems, financial systems, or blockchain and bitcoin environments.
• Security Certifications: One or more recognized offensive-security or blockchain-security credentials strongly preferred, such as OSCP, OSEP, or OSED (Offensive Security); GPEN, GXPN, GWAPT, or GREM (GIAC/SANS); CRTO or CRTL (Zero-Point Security); or a Certified Blockchain Security Professional credential.
• Bitcoin & Blockchain Testing Expertise: Demonstrated hands-on ability to test Bitcoin protocol, wallet, and node implementations, covering key management, multisignature and MPC schemes, PSBT and transaction construction, derivation paths, and on-chain and off-chain attack surfaces.
• Cryptographic Systems & Key Management Proficiency: Deep understanding of cryptographic primitives and protocols, including digital signatures, hashing, key generation, entropy sources, secure key storage, and hardware-backed security mechanisms, and how they fail in real deployments.
• Bitcoin Custody & Wallet Assessment: Experience adversarially assessing Bitcoin custody solutions, including multisignature and hardware wallets, HSMs, recovery mechanisms, signing ceremonies, and operational security controls, with the ability to evaluate third-party custodian security claims.
• Security Research & Threat Analysis: Proven ability to conduct and document original security research and structured technical analysis of custodian, cryptographic, and blockchain systems, translating findings into defensible risk and remediation conclusions.
• Exploit Development & Tooling: Proficiency in one or more of Python, Rust, C/C++, or Go, with the ability to build custom test tooling, fuzzers, and proof-of-concept exploits.
• Communication Skills: Strong written and verbal communication skills with the ability to translate highly technical offensive findings into actionable guidance for engineers, custody teams, executives, and non-technical stakeholders.
• Independent Judgment & Ethics: Demonstrated success operating as a senior individual contributor with high autonomy and sound judgment, and the discipline to handle highly sensitive systems and material safely, ethically, and within authorized scope.

Compensation