Bitcoin Security Engineer

Bitcoin Security Engineer

Job Description 

• This is a fully on-site position Monday through Friday from 8:30 AM to 6:00 PM based at our Tysons Corner Virginia office.

• As a first step in our recruiting process you will be asked to complete an Analytics Assessment and a Cultural Assessment. You will receive both assessments via email through Canditech.

Strategy is expanding its Bitcoin Security program with a dedicated offensive-security function to continuously test validate and harden the security of Strategys bitcoin holdings custody relationships and supporting infrastructure. The Bitcoin Security Engineer is a hands-on deeply technical individual-contributor role responsible for adversarially assessing every layer of Strategys bitcoin security posturefrom cryptographic key material and signing ceremonies to the custodians exchanges and service providers that safeguard institutional-scale bitcoin. 

Where the Director of Bitcoin Security sets architecture and strategy this role validates itprobing wallets hardware protocols and custodial controls to find weaknesses before adversaries do and producing rigorous research and analysis that raises the security bar across the bitcoin custody ecosystem. 

• Bitcoin & Wallet Penetration Testing: Plan and execute hands-on penetration tests against Strategys bitcoin wallet architectures including single-sig multisignature MPC and hardware-wallet deployments targeting key generation storage backup and recovery workflows for exploitable weaknesses. 

• Signing Ceremony & Custody Red-Teaming: Design and run adversarial simulations of signing ceremonies quorum policies and transaction-approval workflows testing for insider-threat social-engineering collusion and operational-security failure modes across cold warm and hot storage tiers. 

• Hardware & Cryptographic Testing: Perform security testing of hardware wallets HSMs secure elements and air-gapped devices including firmware analysis fault-injection and side-channel research entropy and RNG validation and supply-chain tamper assessment. 

• Protocol Node & Transaction-Layer Testing: Test Bitcoin node RPC and transaction-construction surfaces including PSBT handling fee and RBF logic transaction malleability address-generation and derivation-path validation and P2P/mempool-facing attack surfaces. 

• Blockchain Application Security: Assess the security of blockchain-adjacent infrastructure Strategy relies on including smart contracts tokenization platforms bridges oracles and on-chain settlement logic for vulnerabilities and abuse conditions. 

• Elevated Custodian Security Research & Analysis: Lead deep offensive and analytical research into the security posture of Strategys custodians and prospective custodians including qualified custodians exchanges and asset servicers pressure-testing their key-management segregation access-control and recovery claims through structured technical due diligence and adversarial threat modeling. 

• Threat Modeling & Attack Surface Mapping: Build and maintain comprehensive threat models and attack-surface inventories for Strategys end-to-end bitcoin custody chain prioritizing findings by realistic adversary capability and financial impact. 

• Findings Reporting & Remediation Support: Produce clear reproducible penetration-test reports with proof-of-concept exploits severity ratings and pragmatic remediation guidance and partner with engineering and custody teams to validate fixes through retesting. 

• Security Research & Community Engagement: Conduct original research into emerging bitcoin cryptography and blockchain vulnerabilities; responsibly disclose findings; and represent Strategy within the global bitcoin security community including exchanges custodians service providers and core developers. 

• Tooling & Automation: Develop custom tooling harnesses fuzzers and test automation to make bitcoin and custody security testing repeatable scalable and continuous. 

Qualifications :

• Advanced Technical Education: Bachelors degree required in Computer Science Cryptography Information Security Engineering or a related field; Masters Degree in a relevant discipline strongly preferred. Equivalent demonstrable offensive-security experience will be considered. 

• Offensive Security Experience: 6 years of hands-on penetration testing red-team vulnerability research or exploit-development experience with a substantial portion focused on cryptographic systems financial systems or blockchain and bitcoin environments. 

• Security Certifications: One or more recognized offensive-security or blockchain-security credentials strongly preferred such as OSCP OSEP or OSED (Offensive Security); GPEN GXPN GWAPT or GREM (GIAC/SANS); CRTO or CRTL (Zero-Point Security); or a Certified Blockchain Security Professional credential. 

• Bitcoin & Blockchain Testing Expertise: Demonstrated hands-on ability to test Bitcoin protocol wallet and node implementations covering key management multisignature and MPC schemes PSBT and transaction construction derivation paths and on-chain and off-chain attack surfaces. 

• Cryptographic Systems & Key Management Proficiency: Deep understanding of cryptographic primitives and protocols including digital signatures hashing key generation entropy sources secure key storage and hardware-backed security mechanisms and how they fail in real deployments. 

• Bitcoin Custody & Wallet Assessment: Experience adversarially assessing Bitcoin custody solutions including multisignature and hardware wallets HSMs recovery mechanisms signing ceremonies and operational security controls with the ability to evaluate third-party custodian security claims. 

• Security Research & Threat Analysis: Proven ability to conduct and document original security research and structured technical analysis of custodian cryptographic and blockchain systems translating findings into defensible risk and remediation conclusions. 

• Exploit Development & Tooling: Proficiency in one or more of Python Rust C/C or Go with the ability to build custom test tooling fuzzers and proof-of-concept exploits. 

• Communication Skills: Strong written and verbal communication skills with the ability to translate highly technical offensive findings into actionable guidance for engineers custody teams executives and non-technical stakeholders. 

• Independent Judgment & Ethics: Demonstrated success operating as a senior individual contributor with high autonomy and sound judgment and the discipline to handle highly sensitive systems and material safely ethically and within authorized scope. 

Additional Information :

Compensation 

The base salary range for this role is $103900to $186900andrepresentsa good faith estimate of the range at the time of salary ranges to account for differences in skills experience qualifications internal peer equity market conditions and business needs. 

Candidates are typically placed within the range based on these factors and it is not common for individuals to be hired at or near the top of the range. The posted range reflects base salary only. Eligible employees may alsoparticipatein bonus programs sales incentives equity awards and comprehensive benefits as applicable. 

Strategy is an equal opportunity employer. All applicants will receive consideration for employment without regard to race creed color religion national origin gender sex sexual orientation gender identity disability veteran status age genetic information or any other legally-protected basis.

Strategy provides reasonable accommodation for qualified individuals with disabilities in the hiring process.  If you have any difficulty using our online system and you need an accommodation due to a disability you may contact us about your interest in employment at .

Visit Strategys Careers page for additional information.

Remote Work :

No

Employment Type :

Full-time