Security Engineer, Red Team

Coinhako is a leading cryptocurrency and blockchain company dedicated to building a platform users can trust with their assets in a fast-growing, high-stakes environment.

Introduction

Are you ready to be the first line of offense for one of the fastest-growing companies in the Cryptocurrency and Blockchain space? Coinhako is looking for an experienced Security Engineer (Red Team) to think like an adversary, break things before attackers do, and help build a platform users can trust with their assets. In crypto, every vulnerability has an immediate, irreversible dollar value attached, and you'll be operating at that high standard.

Responsibilities

• Plan and execute offensive security engagements across web, mobile, API, microservice surfaces, cloud infrastructure, and internal systems.
• Perform in-depth application security assessments and penetration tests, focusing on critical attack paths in a crypto/fintech context: authentication, session handling, wallet/key management, transaction integrity, withdrawal/KYC bypasses, business logic abuse, and privilege escalation.
• Threat model new and existing products from an attacker's perspective (custody flows, trading engines, on-chain integrations, third-party data exchanges) and translate abstract risks into concrete, testable abuse cases.
• Conduct manual secure code reviews on production codebases to find vulnerabilities scanners miss, with particular attention to financial logic, race conditions, and trust-boundary violations.
• Build tooling: write robust scripts, automate offensive workflows, and create frameworks to scale red team coverage across a fast-moving codebase.
• Partner closely with Engineering, DevOps, Product, and external partners to triage findings, design remediations, and embed security earlier in the SDLC.
• Research emerging threats in Web3, mobile, and cloud (exploitation techniques, smart contract attack patterns, DeFi exploits, supply chain attacks) and translate them into proactive testing methodologies.
• Produce clear, prioritized reports and recommendations articulating technical findings, business impact, and remediation paths for both engineers and executives.
• Provide technical support during incident response and forensic analysis of compromised systems, contributing a red team perspective on attacker tradecraft and evasion.
• Help shape the practices, playbooks, and documentation that define how red teaming is done as the function matures.

Requirements

• 2-3+ years of hands-on experience in offensive security, penetration testing, or red teaming, with demonstrated depth in web and mobile application security.
• Degree in Computer Science, Information Systems, Engineering, or equivalent practical experience.
• Strong fundamentals in offensive security, application security, and security engineering.
• Proven ability to perform manual secure code review on real production codebases across unfamiliar stacks.
• Strong familiarity with Linux and cloud ecosystems, especially AWS.
• Proficiency with industry-standard tooling: Burp Suite, intercepting proxies, fuzzers, and the broader pentester's toolkit.
• Working knowledge of OWASP (Top 10, ASVS, MASVS), CWE, and modern appsec frameworks.
• A builder's mindset — comfortable scripting and automating in Python, Go, or similar to scale your own work.
• Strong intuition for trust boundaries and risk assessment in fast-moving, high-stakes environments.
• Outstanding written and verbal communication in English, with the ability to distill technical nuance into narratives that drive engineering and business change.
• A collaborative spirit, eager to work alongside engineers, researchers, and product teams to embed security into every phase of development.
• Strong interest in Cryptocurrency, Blockchain, Fintech, or Finance/Trading – you follow the space, understand its uniquely hostile threat environment, and want to defend it.
• Proficient in English communication skills.
• Advanced understanding and/or experience working in a Cryptocurrency/Blockchain/Fintech/Finance Trading domain preferred.

Nice to Have

• Hands-on experience in a Cryptocurrency, Blockchain, Fintech, or Trading environment, including familiarity with custody models, exchange architecture, or smart contract security (Solidity/EVM, common DeFi attack patterns).
• Experience with red team exercises, APT simulations, and adversary emulation using frameworks like MITRE ATT&CK.
• Experience pentesting across heterogeneous stacks — backend services, cloud-native environments, mobile (iOS/Android), and Web3.
• Familiarity with Agile SDLC, DevSecOps practices, and CI/CD security.
• Exposure to Ruby on Rails or other languages prominent in our stack.
• Working knowledge of relevant regulations (e.g., GDPR, CCPA, MAS, financial compliance) and how they map to technical controls.
• Visible contributions to the community: public research, conference talks, blog posts, CVEs, OSS security tooling, or a strong bug bounty track record on HackerOne, Bugcrowd, Intigriti, YesWeHack, or similar.
• Preferred certifications: OSCP, OSWE, OSCE3, HTB CWES/CWEE, or equivalent.

Benefits

• MacBook or high-end laptop for working.
• Full coverage of social insurance.
• Premium health care for you and your family members.
• Full 100% salary during probationary period.
• Working in a professional, friendly, well-equipped workspace with both foreigners and Vietnamese.
• Extensive on-job training; always having chances to work with new emerging technologies.
• Friendly and fun start-up work culture.

About Company

Coinhako is a leading cryptocurrency and blockchain company dedicated to building a platform users can trust with their assets in a fast-growing, high-stakes environment.