About the role

We are seeking a hands-on Security Engineer who thrives in a startup environment.

You'll work alongside product owners and engineers with the objective to secure the products in Startale's ecosystem. Products include a next-generation decentralized exchange with a fully on-chain order book (Strium), a user-facing application (StartaleApp) and a stablecoin (USDSC). This is a hands-on, technical role. You'll be the person who actively tests our systems, hunts for vulnerabilities, models threats against our products, and works with engineers to close the gaps — not the person who writes policies and generates reports. You'll report to the Security Lead and collaborate daily with Backend, Frontend, DevOps, and Blockchain engineering teams.

Why this role

• Startale's products handle user funds and on-chain transactions so security work has tangible impact.
• Owning the security posture of a project at scale and complexity such as Strium is an opportunity for professional growth.
• You will have direct influence over how product security is built across the organization.
• Focus is on driving product security and not on maintaining compliance documentation.
• Our team is backed by and partnering with leading Japanese enterprises so you will have a chance to work in a stable and well-funded company but with the autonomy and speed of a small team.

Key responsibilities

• Security Assessments & Penetration Testing: Conduct hands-on security testing of our applications, APIs, and infrastructure. Simulate real attack scenarios against our products. Find the vulnerabilities before external attackers or whitehat researchers do. Work with engineers to fix issues pragmatically.
• Threat Modeling: Build threat models for new services and features — especially Strium's trading engine, order book, and transaction flows. Identify attack surfaces, model adversary behavior, and define what needs to be hardened before launch.
• Vulnerability Triage & Remediation: Own the end-to-end lifecycle of findings — from discovery through severity assessment, developer-facing write-ups, remediation guidance, and verification of fixes. Coordinate with engineers so issues actually get closed.
• Vulnerability Disclosure & Bug Bounty: Manage incoming whitehat reports, validate findings by reproducing them, assess severity, communicate with researchers.
• AI Tools Security Support: Assess technical risks related to AI tools used within teams (such as data exfiltration, prompt injection, training-on-input), maintain security baselines for AI coding tools and review AI-powered internal tools.

Qualifications

Must-have

• 5+ years of hands-on experience with a focus on application security, penetration testing, or product security.
• Demonstrated ability to find vulnerabilities — through manual testing, architecture and/or code review, or creative attack simulation. You should be able to describe specific bugs you've found and how you found them.
• Practical experience with exchange or trading platform security — from a DEX (preferred) or DeFi protocol. You should understand order book mechanics, transaction flows, wallet security, and the threat landscape specific to trading infrastructure.
• Scripting and automation ability — you write tools and automate to scale security across the stack, not just audit and write reports.
• Experience triaging vulnerabilities and writing clear, actionable remediation guidance for developers.
• Strong written communication in English — you'll write tickets, assessment reports and researcher responses.

Strong plus

• Experience with cloud infrastructure security — least-privilege enforcement, network security, secrets management.
• Experience with container security — network policies, RBAC, pod security standards, image scanning, Dockerfile hardening, base image management.
• Ability to read and review code in at least one of: TypeScript/JavaScript, Solidity, Rust.
• Understanding of software supply chain security, including dependency risks, build integrity, and methods for tracking what components are included in shipped software.
• Experience managing or participating in a bug bounty program (e.g. Immunefi, HackerOne).

Domain plus

• Experience securing AI/LLM tooling in engineering teams — prompt injection risks, data leakage prevention, tool configuration hardening
• Japanese language ability (not required, but useful for company context)

Location / Timezone

• Strong preference for Tokyo-based or Singapore-based candidates - Startale office locations.
• Remote-friendly for exceptional candidates — must have 3+ hours overlap with Tokyo business hours (JST, UTC+9).

Target start date

• As soon as available; realistic target start of Q3 2026.

Target companies

Decentralized exchanges, DeFi protocols, blockchain security firms, L1/L2 chain security teams, or fintech companies with trading infrastructure. We're also open to strong AppSec engineers from cloud-native startups who have genuine interest in web3.

Ideal candidate

You're a hands-on security engineer who finds real vulnerabilities, not just runs scanners. You've secured a trading platform or exchange and understand the threats specific to financial infrastructure — order book manipulation, transaction signing, wallet compromise, front-running. You can take a system, map the attack surface, and come back with findings that matter. You write clear reports that engineers act on, and you know the difference between a theoretical risk and a real one. You're comfortable working independently in a fast-moving team where there's no playbook — you write the playbook.

About Us

In partnership with SBI Group, we aim to bring the majority of Japanese equities on-chain, creating a secure, transparent, and high-performance trading infrastructure that can support institutional volumes while remaining accessible to retail participants. We are building a next-generation decentralized exchange with a fully on-chain order book. Our system is built with a custom state transition function and consensus layer, purpose-designed for high-performance, low-latency trading. The goal is to deliver a trustless platform that matches the speed and efficiency of traditional trading engines while providing full transparency by running execution as close as possible to the blockchain itself.

Position Overview

We are looking for a Senior Rust Engineer with strong expertise in system architecture and execution engines. You will be responsible for designing and implementing the CLOB execution layer, including the order book, matching engine, and blockchain client logic. This role is highly technical and requires end-to-end ownership of critical components, from architecture to optimization. While you’ll primarily collaborate with a remote team of experienced engineers, there will occasionally be opportunities to work onsite during offsite sessions to support onboarding and enable more efficient collaboration.

Joining at this early stage of development offers a unique opportunity to influence critical technical decisions, achieve career growth, and enjoy competitive compensation.

Key Responsibilities

• Architect and implement the on-chain order book and matching engine in Rust.
• Design and extend exchange-specific logic (order execution, risk checks, account/state management).
• Design and develop protocol-level components, such as state transition logic, consensus, validator interaction, and transaction processing pipelines.
• Implement integration with oracles, bridges, and external data providers, ensuring correctness and resilience in adversarial conditions.
• Optimize for low-latency execution, concurrency, and gas efficiency.
• Conduct benchmarking and stress testing to identify and address potential performance/throughput bottlenecks.
• Develop and maintain a comprehensive suite of unit, integration, and end-to-end tests to ensure code reliability and functionality.

Requirements

• 5+ years of systems programming experience, with 3+ years in Rust.
• Proven track record building trading platforms, execution engines, or exchanges (DEX or centralized).
• Contributions to Rust-based L1 protocol projects (e.g., Solana, Cosmos SDK, Substrate).
• Deep understanding of distributed computing principles, including consensus algorithms, peer-to-peer (P2P) networking, and high-performance data structures.
• Deep knowledge of decentralized trading models (on-chain order books, AMMs, hybrid architectures).
• Ability to design and implement complex, production-grade systems independently.

Big Bonus

• Experience with competitive programming or algorithmic problem solving.
• Expertise in low-latency design, concurrency, and performance optimization.

About the role

In partnership with SBI Group, we are building a next-generation decentralized exchange (DEX) aimed at bringing the majority of Japanese equities on-chain. Our goal is to create a secure, transparent, and high-performance trading infrastructure capable of supporting institutional volumes while remaining accessible to retail participants. The platform features a fully on-chain order book and is powered by a custom state transition function and consensus layer, purpose-built for low-latency, high-throughput trading.

As the Senior QA Engineer, you will be the quality champion for this system and cover core trading flows, order book behavior, matching logic, and backend services powering execution. As the first senior-level QA on the team, you will own the end-to-end quality strategy with a strong emphasis on automation, ensuring the correctness, reliability, and performance of both API and E2E layers under real-world trading conditions.

This is a hands-on role focused on building robust E2E and API test coverage, not manual testing.

Key responsibilities

• Quality strategy & process: Define and evolve QA standards, release criteria, and quality metrics tailored to a trading platform. Establish best practices for validating execution accuracy, pricing, and API reliability.

• Automation (E2E-first approach):

  Design, build, and maintain a scalable end-to-end automation framework for the web app, covering critical user journeys.

• API testing & validation:

  Develop comprehensive automated tests for backend services and APIs. Ensure consistency between API responses and frontend behavior.

• Trading logic validation:

  Validate correctness of execution paths, price impact, and fee calculations across different trading pairs and liquidity sources.

• Performance & reliability:

  Drive API-level load and stress testing for high-throughput scenarios. Validate system behavior under peak traffic and degraded conditions (timeouts, partial failures, node issues).

• Test data & environment strategy:

  Design reliable test environments and datasets (mocked or real blockchain interactions), ensuring repeatability of E2E and API tests.

• Cross-team collaboration & leadership:

  Work closely with Engineering and Product to define testable acceptance criteria. Take ownership of QA processes, drive automation adoption, and set quality standards across the team.

Qualifications

Required experiences

• 3+ years in QA for web or fintech products, with at least 2+ years focused on test automation and E2E testing.
• Strong experience building and maintaining E2E test frameworks (e.g. Playwright, Cypress, or similar).
• Solid experience in API testing and automation (REST, JSON-RPC, or similar).
• Strong JavaScript/TypeScript skills.
• Experience testing complex transactional or financial systems.
• Good understanding of trading concepts: slippage, liquidity, routing paths, execution flow.
• Experience designing stable, maintainable automated test suites (CI integration, flakiness reduction).

Nice-to-have

• Experience testing DEXs, trading platforms, or financial systems.
• Familiarity with blockchain basics, smart contracts, and on-chain transaction flows.
• Understanding of AMMs, liquidity pools, and routing algorithms.
• Experience with performance/API load testing tools (e.g. k6, Artillery).
• Experience using AI tools to improve test generation and coverage.

About Us

In partnership with one of the largest financial conglomerates, we aim to bring the majority of Japanese equities on-chain, creating a secure, transparent, and high-performance trading infrastructure that can support institutional volumes while remaining accessible to retail participants. We are building a next-generation decentralized exchange with a fully on-chain order book. Our system is built with a custom state transition function and consensus layer, purpose-designed for high-performance, low-latency trading. The goal is to deliver a trustless platform that matches the speed and efficiency of traditional trading engines while providing full transparency by running execution as close as possible to the blockchain itself.

Position Overview

We are seeking a Senior Rust Backend Engineer experienced in building high-performance, reliable trading APIs (HTTP & WebSocket). You will be responsible for designing, implementing, and optimizing the backend services that power our exchange interfaces - ensuring low latency, resilience, and correctness under load.

You’ll work on high-throughput, real-time systems that handle order and trade data ingestion, manage live WebSocket feeds, and maintain internal state consistency from streaming market events. The ideal candidate is both a strong Rust engineer and a system thinker, capable of reasoning about concurrency, data flow, and observability in production environments.

This role offers an opportunity to shape the architecture of our trading backend at an early stage, working alongside a distributed team of seasoned engineers building next-generation financial infrastructure.

Key Responsibilities

• Own the architecture and technical direction of high-performance trading APIs (HTTP & WebSocket) supporting low-latency order entry, market data distribution, and account state updates.
• Lead the design and implementation of structured concurrency using the Tokio runtime, defining best practices for task lifecycle management, cancellation semantics, backpressure, and graceful degradation under load.
• Develop and maintain real-time state ingestion pipelines:
  • Process append-only logs (e.g., trades, order updates, book diffs).
  • Rebuild local states efficiently using snapshot + diff application.
• Model trading-related data structures, including orders, fills, trades, positions, funding, and liquidation logic.
• Implement WebSocket connection logic, including upgrade handling, frame parsing, and data fanout for subscribed clients.
• Design observable backend systems with rich metrics, structured logging, and distributed tracing for performance insights and failure analysis.
• Collaborate with system and infrastructure engineers to continuously improve performance, scalability, and fault tolerance.
• Write comprehensive unit, integration, and load tests to ensure stability under production conditions.

Requirements

Rust Expertise

• 5+ years of professional backend engineering experience, with 3+ years of Rust in production.
  • Strong experience with the Tokio async runtime and concurrent programming patterns.
  • Deep understanding of structured concurrency and robust handling of spawned task cancellation.
  • Hands-on experience with HTTP and WebSocket frameworks such as Hyper or similar.

Trading Literacy

• Solid understanding of CEX/DEX systems and trading models.
• Familiarity with data modeling for trading entities (orders, trades, positions, funding, mark price, margin, liquidation logic, etc.).
• Prior hands-on trading or market data experience (personal or professional).

State Ingestion & Processing

• Expertise in real-time data streaming and processing systems.
• Ability to design systems that rebuild local state efficiently from snapshots and diffs.
• Familiarity with replay, recovery, and correctness guarantees in event-driven systems.

WebSocket Engineering

• Understanding of connection upgrades, frame parsing, and data fanout for subscribed clients.

Observability Engineering

• Ability to design and instrument systems for metrics, logging, and tracing.
• Experience with Prometheus and OpenTelemetry in production.
• Track record of diagnosing and resolving performance bottlenecks and production incidents.

Big Bonus

Performance Engineering

• Deep understanding of lock-free or lock-avoidant data structures
• Experience designing cache-friendly data layouts and optimizing for memory locality in latency-sensitive systems.
• Proficiency in profiling CPU and memory performance and able to diagnose and optimize latencies in real-time event pipelines

DevOps & CI/CD

• Familiarity with Docker-based environments and CI/CD pipelines.

Why Join Us

• Work on cutting-edge trading infrastructure bridging traditional and decentralized finance.
• Collaborate with a world-class, distributed engineering team.
• Influence critical technical decisions from the early stages.
• Competitive compensation and growth opportunities in a rapidly evolving space.