About the Role

You will be the hands-on security engineer working directly under our Head of Security, owning the security of our cloud infrastructure and the detection and response capability that protects the exchange and its business units.

You will harden AWS to a defensible baseline, build the detection pipeline that catches attackers, stop initial access, lead incident response during Hong Kong hours, and use LLM-driven agents (Strix, Cairn-style harnesses, Claude / GPT-based tooling) to automate the offensive testing and triage.

What You will Do

1. Cloud and Infrastructure Hardening

Own the security posture of AWS: IAM least privilege, SCPs and Organizations guardrails, VPC segmentation, KMS and secrets management, CIS benchmarks, and infrastructure-as-code review.
Harden Kubernetes and containerised workloads: admission control, image signing, runtime policy, network policy, and workload identity.
Operate a CSPM / CNAPP platform (Wiz, Prisma Cloud, AWS Security Hub or similar) and drive misconfiguration findings to closure with engineering.
Own identity and access as the first line of defence: phishing-resistant MFA, conditional access, just-in-time privileged access, service-account and API-key lifecycle, and ongoing access reviews
Define and enforce the change-management and deployment controls that prevent process failures from becoming incidents: break the glass procedures, production changes.

2. Detection and Response

Build and tune detection in the log system: log coverage across CloudTrail, GuardDuty, Kubernetes audit, EDR, identity provider, VPN and SaaS.
Build exchange-specific detections: withdrawal-flow anomalies, API-key abuse, admin-panel misuse, hot and cold wallet movements on-chain, and insider-threat signals
Operate EDR / XDR (CrowdStrike, SentinelOne or Microsoft Defender) across endpoints, servers and cloud workloads, including the response playbooks
Own incident response end-to-end during Hong Kong hours and non-office hour: From triage, containment, cloud and host forensics, communication, post-mortems, lesson learn and coordination with our managed detection provider

3. AI Offensive Security

Run autonomous AI pentest agents (Strix, Cairn-style harnesses, or equivalent) against exchange APIs, web and mobile frontends, admin panels and cloud infrastructure.
Lead purple-team exercises that replay realistic attack paths: AI-agent-driven initial access, API-key theft, withdrawal-logic bypass, account takeover, and insider threat; close the gaps found and measure detection coverage before and after
Use LLMs to scale security operations: alert summarisation, log query generation, detection-rule fine tuning.

4. Exchange and Security Code Review

Conduct deep-dive source code reviews of exchange Infrastructure, prioritizing MPC/HSM integrations and withdrawal approval logic.
Inspect the source code and on-chain monitoring tools to ensure secure data handling and robust integration with detection pipelines.
Triage and manually validate findings from SCA & SAST & DAST, and secrets-scanning tools to recommend secure code remediations.

Requirements

5+ years in security engineering, with at least 3 years hands-on in cloud security on AWS, and at least 1 year at a crypto exchange, custodian or high-value fintech
Detection engineering experience: you have written and tuned SIEM detections as code, measured false-positive rates, and can show detections in real world attack.
Incident response experience in cloud environments: you have led at least one real incident through containment, forensics and post-mortem, and can walk through it
Hands-on experience with autonomous or LLM-driven security tooling: you have run AI pentest agents (Strix, Cairn-style harnesses, XBOW or equivalent) or built LLM-assisted
Experience deploying and operating an EDR / XDR platform and a CSPM
Working knowledge of exchange attack paths: API-key abuse, withdrawal-flow bypass, account takeover, and the basics of wallet architecture (MPC / HSM, hot / cold flows)
OSCP is highly preferable, also one the following: AWS Certified Security, Professional Cloud Security Engineer, CKS, GCIH, GCFA.
Fluent in Cantonese is a strong advantage for working with local teams

Humanity jobs

Senior Security Engineer

Never Miss a New Opportunity