Secuity Engineer

Company Description Bitword Ltd is dedicated to building a world-class cryptocurrency futures and derivatives trading ecosystem for users around the globe. The company focuses on delivering a professional, secure, and highly efficient contract trading experience, emphasizing reliability and performance. Bitword invests in advanced technologies and robust security measures to protect digital assets and transactions. Team members join a fast-paced, innovation-driven environment at the intersection of finance and cutting-edge blockchain technology. Role Description This is a full-time Security Engineer role based in Hong Kong SAR with a hybrid work arrangement, allowing a combination of on-site and work-from-home days. The Security Engineer will design, implement, and maintain security controls across infrastructure, networks, and systems supporting the cryptocurrency trading platform. Daily responsibilities include monitoring security events, investigating incidents, performing risk assessments, and collaborating with engineering teams to remediate vulnerabilities. The role involves reviewing system architectures, configuring security tools, conducting security audits, and documenting security policies and procedures. The Security Engineer will also help educate colleagues on security best practices and support compliance with relevant industry standards. Responsibilities
- Own end-to-end company security architecture: network, application, data, and cloud security.
- Execute penetration testing, vulnerability scanning, and security assessments; drive closed-loop remediation.
- Build and operate security infrastructure (WAF, IDS/IPS, SIEM).
- Configure and harden AWS environments (IAM least-privilege, security groups, VPC isolation, CloudTrail auditing).
- Define and enforce Secure Development Lifecycle (SDL); participate in requirements review and code security audits.
- Monitor security events; perform rapid incident response and root-cause analysis.
- Establish and maintain key, certificate, and private-key management systems.
- Design specialized controls for crypto-native risks: smart contracts, wallet systems, and API surfaces.
- Drive security compliance aligned with regulatory requirements (including data protection under KYC/AML).
- Run regular security exercises (red-blue team, phishing simulations) to raise organizational security posture. Requirements
- Bachelor’s degree in computer science or related field; 3+ years in security engineering or penetration testing.
- Strong command of common vulnerabilities (OWASP Top 10, SQLi, XSS, SSRF, deserialization, etc.) and corresponding fixes.
- Hands-on experience with AWS security services (IAM, KMS, Security Hub, GuardDuty, WAF).
- Proficient with penetration-testing tools (Burp Suite, Nmap, Metasploit).
- Solid fundamentals in network security: firewalls, VPN, TLS/SSL, PKI.
- Programming ability in Python, Go, or Shell sufficient to write security tools and automation.
- Understanding of blockchain and smart-contract security; digital-asset security experience preferred.
- Security certifications (CISSP, OSCP, CEH, etc.) preferred.
•
- Strong written communication and cross-team influence; able to drive security practices into engineering workflows.