About Legacy Legacy is an easy-to-use, non-custodial Web3 wallet designed to protect digital assets through beneficiary protection and seamless DeFi access. Users can swap across chains, earn yield in one click, and safeguard wealth for the next generation.

About the Software Division We are building a portfolio of software products inside the Decentralized Masters ecosystem, including:

Legacy Wallet - a non-custodial Web3 wallet with beneficiary protection and seamless DeFi access

Trading Bot - automated crypto execution tools for serious investors

Future fintech and investor infrastructure tools

We are now building the retention and lifecycle engine that will power long‑term recurring revenue across all products.

About The Role You will be the single person responsible for the security of a platform that tracks hundreds of millions in digital assets. That is the job. Everything else is secondary.

We need someone who breaks things for a living. Someone who looks at a login page and sees six attack vectors. Someone who reads a pull request and catches the injection vulnerability that two senior developers missed. Someone who lies awake thinking about the phishing campaign that hasn’t been invented yet. If that sounds exhausting, this is not your role. If that sounds like Tuesday, keep reading.

Your primary responsibilities are security and quality assurance. You own penetration testing, vulnerability assessments, threat modeling, automated test frameworks, and CI quality gates across every product we ship. You also own infrastructure: AWS, CI/CD pipelines, monitoring, and incident response. And because we are a small, senior team, you will write production code when security and QA responsibilities are covered.



You are not a consultant or a checkbox auditor. You are an engineer who ships, and whose code happens to make everything else harder to break.

The adecuado candidate has spent time at major product‑driven fintech and crypto companies where a single security failure can destroy user trust overnight.

Security (Primary)

Own the security posture across all products: Legacy, Trading Bot, and future platforms. If something gets breached, it is your problem. If nothing gets breached, it is because of your work

Conduct regular penetration testing, vulnerability assessments, and threat modeling aligned with OWASP standards and methodologies

Ensure full coverage of the OWASP Top 10 in application security testing, code reviews, and deployment checks

Perform security‑focused code reviews across frontend, backend, and infrastructure code, catching what standard code reviews miss

Implement and manage secrets management (Vault, AWS Secrets Manager, or KMS), access controls, and least‑privilege policies

Build and maintain incident response playbooks. When something breaks, you lead the response, run the post‑mortem, and ship the fix

Stay ahead of Web3 and crypto‑specific attack vectors: phishing campaigns, wallet exploits, API key compromises, supply chain attacks, and social engineering





Manage and coordinate external security audits and penetration tests from third‑party firms

Quality Assurance & Testing (Primary)

Design and implement test strategies across all products: unit tests, integration tests, end‑to‑end tests, API tests, and regression suites

Build and maintain automated testing frameworks and CI quality gates that prevent broken code from reaching production

Define and track quality metrics: test coverage, flakiness rate, regression detection latency, and bug escape rate

Write and execute security test cases: authentication flows, authorization controls, input validation, API abuse scenarios, and edge cases around financial data

Perform both white‑box and black‑box testing, leveraging full codebase access to catch issues that surface‑level QA would miss

Test across the full stack: frontend UI, backend APIs, database queries, third‑party integrations, and on‑chain interactions

Infrastructure & DevOps (Foundation)

Maintain and improve cloud infrastructure on AWS using Infrastructure as Code (Terraform or CloudFormation)

Own CI/CD pipelines (GitHub Actions preferred): automated testing, security scanning, linting, and deployment

Harden infrastructure: network security, IAM policies, container security, and environment isolation

Build logging, monitoring, and alerting across all services (CloudWatch, Prometheus, Grafana, or equivalent)

Ensure audit trails for user actions, system changes, and access events

Manage production reliability, incident response, and cost optimization

Fullstack Development (When the fortress is secure)

Contribute production code across frontend and backend, bringing a security‑first mi

📌 DevOps Security Engineer (Barcelona)
🏢 Decentralized Masters
📍 Barcelona