About LegacyLegacy is an easy-to-use, non-custodial Web3 wallet designed to protect digital assets through beneficiary protection and seamless DeFi access. Users can swap across chains, earn yield in one click, and safeguard wealth for the next generation.
About the Software DivisionWe are building a portfolio of software products inside the Decentralized Masters ecosystem, including:Legacy Wallet
- a non-custodial Web3 wallet with beneficiary protection and seamless DeFi accessTrading Bot
- automated crypto execution tools for serious investorsFuture fintech and investor infrastructure toolsWe are now building the retention and lifecycle engine that will power long?

About The Role
You will be the single person responsible for the security of a platform that tracks hundreds of millions in digital assets. Someone who reads a pull request and catches the injection vulnerability that two senior developers missed. Your primary responsibilities are security and quality assurance. You own penetration testing, vulnerability assessments, threat modeling, automated test frameworks, and CI quality gates across every product we ship. AWS, CI/CD pipelines, monitoring, and incident response. And because we are a small, senior team, you will write production code when security and QA responsibilities are covered. driven fintech and crypto companies where a single security failure can destroy user trust overnight.
Security (Primary)Own the security posture across all products: If something gets breached, it is your problem. If nothing gets breached, it is because of your workConduct regular penetration testing, vulnerability assessments, and threat modeling aligned with OWASP standards and methodologiesEnsure full coverage of the OWASP Top 10 in application security testing, code reviews,



and deployment checksPerform security?focused code reviews across frontend, backend, and infrastructure code, catching what standard code reviews missImplement and manage secrets management (Vault, AWS Secrets Manager, or KMS), access controls, and least?specific attack vectors: phishing campaigns, wallet exploits, API key compromises, supply chain attacks, and social engineeringManage and coordinate external security audits and penetration tests from third?party firmsQuality Assurance & Testing (Primary)Design and implement test strategies across all products: unit tests, integration tests, end?to?end tests, API tests, and regression suitesBuild and maintain automated testing frameworks and CI quality gates that prevent broken code from reaching productionDefine and track quality metrics: test coverage, flakiness rate, regression detection latency, and bug escape rateWrite and execute security test cases: authentication flows, authorization controls, input validation, API abuse scenarios, and edge cases around financial dataPerform both white?box testing, leveraging full codebase access to catch issues that surface?level QA would missTest across the full stack: frontend UI, backend APIs, database queries, third?chain interactionsInfrastructure & DevOps (Foundation)Maintain and improve cloud infrastructure on AWS using Infrastructure as Code (Terraform or CloudFormation)Own CI/CD pipelines (GitHub Actions preferred): automated testing,



security scanning, linting, and deploymentHarden infrastructure: network security, IAM policies, container security, and environment isolationBuild logging, monitoring, and alerting across all services (CloudWatch, Prometheus, Grafana, or equivalent)Ensure audit trails for user actions, system changes, and access eventsManage production reliability, incident response, and cost optimizationFullstack Development (When the fortress is secure)Contribute production code across frontend and backend, bringing a security?first mindset to every feature you buildBuild features, fix bugs, and ship improvements alongside the engineering teamEvery line you write should make the product better and harder to break: input validation, error handling, authentication, and data protection by defaultParticipate in architecture discussions and code reviews, advocating for testability, reliability, and security in every decisionRequirementsRequired5+ years in software engineering roles with meaningful, hands?on security and QA experience. If your security experience is theoretical, this is not the right fitFullstack development

experience:
you can build and ship features across frontend (React or equivalent) and backend (Node.
Js, Python, Go, or equivalent)Hands?on penetration testing and vulnerability assessment experience across web applications, APIs, and cloud infrastructureStrong working knowledge of OWASP standards, including the OWASP Top 10, OWASP Testing Guide, and OWASP secure coding practicesExperience building automated test frameworks and integrating testing into CI/CD pipelinesAWS expertise (EC2, ECS/EKS, Lambda, VPC, IAM, S3, RDS, CloudFront, WAF)Infrastructure as Code experience (Terraform, CloudForm

📌 DevOps Security Software Engineer (España)
🏢 Decentralized Masters
📍 España