About the role

We are seeking a hands-on Security Engineer who thrives in a startup environment.

You'll work alongside product owners and engineers with the objective to secure the products in Startale's ecosystem. Products include a next-generation decentralized exchange with a fully on-chain order book (Strium), a user-facing application (StartaleApp) and a stablecoin (USDSC). This is a hands-on, technical role. You'll be the person who actively tests our systems, hunts for vulnerabilities, models threats against our products, and works with engineers to close the gaps — not the person who writes policies and generates reports. You'll report to the Security Lead and collaborate daily with Backend, Frontend, DevOps, and Blockchain engineering teams.

Why this role

• Startale's products handle user funds and on-chain transactions so security work has tangible impact.
• Owning the security posture of a project at scale and complexity such as Strium is an opportunity for professional growth.
• You will have direct influence over how product security is built across the organization.
• Focus is on driving product security and not on maintaining compliance documentation.
• Our team is backed by and partnering with leading Japanese enterprises so you will have a chance to work in a stable and well-funded company but with the autonomy and speed of a small team.

Key responsibilities

• Security Assessments & Penetration Testing: Conduct hands-on security testing of our applications, APIs, and infrastructure. Simulate real attack scenarios against our products. Find the vulnerabilities before external attackers or whitehat researchers do. Work with engineers to fix issues pragmatically.
• Threat Modeling: Build threat models for new services and features — especially Strium's trading engine, order book, and transaction flows. Identify attack surfaces, model adversary behavior, and define what needs to be hardened before launch.
• Vulnerability Triage & Remediation: Own the end-to-end lifecycle of findings — from discovery through severity assessment, developer-facing write-ups, remediation guidance, and verification of fixes. Coordinate with engineers so issues actually get closed.
• Vulnerability Disclosure & Bug Bounty: Manage incoming whitehat reports, validate findings by reproducing them, assess severity, communicate with researchers.
• AI Tools Security Support: Assess technical risks related to AI tools used within teams (such as data exfiltration, prompt injection, training-on-input), maintain security baselines for AI coding tools and review AI-powered internal tools.

Qualifications

Must-have

• 5+ years of hands-on experience with a focus on application security, penetration testing, or product security.
• Demonstrated ability to find vulnerabilities — through manual testing, architecture and/or code review, or creative attack simulation. You should be able to describe specific bugs you've found and how you found them.
• Practical experience with exchange or trading platform security — from a DEX (preferred) or DeFi protocol. You should understand order book mechanics, transaction flows, wallet security, and the threat landscape specific to trading infrastructure.
• Scripting and automation ability — you write tools and automate to scale security across the stack, not just audit and write reports.
• Experience triaging vulnerabilities and writing clear, actionable remediation guidance for developers.
• Strong written communication in English — you'll write tickets, assessment reports and researcher responses.

Strong plus

• Experience with cloud infrastructure security — least-privilege enforcement, network security, secrets management.
• Experience with container security — network policies, RBAC, pod security standards, image scanning, Dockerfile hardening, base image management.
• Ability to read and review code in at least one of: TypeScript/JavaScript, Solidity, Rust.
• Understanding of software supply chain security, including dependency risks, build integrity, and methods for tracking what components are included in shipped software.
• Experience managing or participating in a bug bounty program (e.g. Immunefi, HackerOne).

Domain plus

• Experience securing AI/LLM tooling in engineering teams — prompt injection risks, data leakage prevention, tool configuration hardening
• Japanese language ability (not required, but useful for company context)

Location / Timezone

• Strong preference for Tokyo-based or Singapore-based candidates - Startale office locations.
• Remote-friendly for exceptional candidates — must have 3+ hours overlap with Tokyo business hours (JST, UTC+9).

Target start date

• As soon as available; realistic target start of Q3 2026.

Target companies

Decentralized exchanges, DeFi protocols, blockchain security firms, L1/L2 chain security teams, or fintech companies with trading infrastructure. We're also open to strong AppSec engineers from cloud-native startups who have genuine interest in web3.

Ideal candidate

You're a hands-on security engineer who finds real vulnerabilities, not just runs scanners. You've secured a trading platform or exchange and understand the threats specific to financial infrastructure — order book manipulation, transaction signing, wallet compromise, front-running. You can take a system, map the attack surface, and come back with findings that matter. You write clear reports that engineers act on, and you know the difference between a theoretical risk and a real one. You're comfortable working independently in a fast-moving team where there's no playbook — you write the playbook.

About the role

In partnership with SBI Group, we are building a next-generation decentralized exchange (DEX) aimed at bringing the majority of Japanese equities on-chain. Our goal is to create a secure, transparent, and high-performance trading infrastructure capable of supporting institutional volumes while remaining accessible to retail participants. The platform features a fully on-chain order book and is powered by a custom state transition function and consensus layer, purpose-built for low-latency, high-throughput trading.

As the Senior QA Engineer, you will be the quality champion for this system and cover core trading flows, order book behavior, matching logic, and backend services powering execution. As the first senior-level QA on the team, you will own the end-to-end quality strategy with a strong emphasis on automation, ensuring the correctness, reliability, and performance of both API and E2E layers under real-world trading conditions.

This is a hands-on role focused on building robust E2E and API test coverage, not manual testing.

Key responsibilities

• Quality strategy & process: Define and evolve QA standards, release criteria, and quality metrics tailored to a trading platform. Establish best practices for validating execution accuracy, pricing, and API reliability.

• Automation (E2E-first approach):

  Design, build, and maintain a scalable end-to-end automation framework for the web app, covering critical user journeys.

• API testing & validation:

  Develop comprehensive automated tests for backend services and APIs. Ensure consistency between API responses and frontend behavior.

• Trading logic validation:

  Validate correctness of execution paths, price impact, and fee calculations across different trading pairs and liquidity sources.

• Performance & reliability:

  Drive API-level load and stress testing for high-throughput scenarios. Validate system behavior under peak traffic and degraded conditions (timeouts, partial failures, node issues).

• Test data & environment strategy:

  Design reliable test environments and datasets (mocked or real blockchain interactions), ensuring repeatability of E2E and API tests.

• Cross-team collaboration & leadership:

  Work closely with Engineering and Product to define testable acceptance criteria. Take ownership of QA processes, drive automation adoption, and set quality standards across the team.

Qualifications

Required experiences

• 3+ years in QA for web or fintech products, with at least 2+ years focused on test automation and E2E testing.
• Strong experience building and maintaining E2E test frameworks (e.g. Playwright, Cypress, or similar).
• Solid experience in API testing and automation (REST, JSON-RPC, or similar).
• Strong JavaScript/TypeScript skills.
• Experience testing complex transactional or financial systems.
• Good understanding of trading concepts: slippage, liquidity, routing paths, execution flow.
• Experience designing stable, maintainable automated test suites (CI integration, flakiness reduction).

Nice-to-have

• Experience testing DEXs, trading platforms, or financial systems.
• Familiarity with blockchain basics, smart contracts, and on-chain transaction flows.
• Understanding of AMMs, liquidity pools, and routing algorithms.
• Experience with performance/API load testing tools (e.g. k6, Artillery).
• Experience using AI tools to improve test generation and coverage.

About the role

You will be a senior contributor to our frontend product experience, working across our product suite, including our self-custodial wallet interfaces, account abstraction user flows, and a growing set of web and mobile decentralized applications (dApps). As a senior frontend engineer on the team, you will help shape frontend architecture, deliver complex user-facing features, and embed performance, reliability, and usability best practices into every release.

You will work closely with designers, product managers, and engineers to take features from concept to production, while contributing to improving code quality, system design, and team workflows.

Key responsibilities

Frontend architecture & technical contributions: Contribute to the evolution of frontend system design, patterns, and best practices.

Application development: Design, build, and maintain complex, production-grade frontend applications using TypeScript and TanStack Start.

State management & data orchestration: Implement and maintain scalable client-side state using Zustand and TanStack Query to ensure predictable and performant data flows.

Project ownership: Own and deliver end-to-end frontend workstreams, including:

• Core wallet and account abstraction UX flows
• High-throughput, data-rich product interfaces
• New web and mobile dApp surfaces

Testing & reliability: Contribute to and maintain Playwright-based end-to-end test suites to improve coverage and release confidence.

Cross-functional collaboration: Partner with Product, Design, and Backend teams to refine requirements and deliver high-quality outcomes.

Qualifications

Required experience

• 2 ~ 4 years of experience as a frontend engineer
• Strong proficiency in TypeScript and modern JavaScript.
• Experience with TanStack Start or comparable meta-frameworks (e.g., Next.js, Remix).
• Solid expertise in modern React patterns, performance optimization, and frontend application design.
• Ability to operate independently in ambiguous, fast-paced environments.
• Excellent written and verbal communication skills.

Nice-to-have

• Experience leveraging AI-assisted coding tools (Cursor, Copilot, Claude, or similar) to accelerate development.
• Background in web3, blockchain, or decentralized application development.
• Experience in startup or scale-up environments.

Location and logistics

• East Asia preferred (Tokyo, Singapore, HongKong)

About Us

In partnership with one of the largest financial conglomerates, we aim to bring the majority of Japanese equities on-chain, creating a secure, transparent, and high-performance trading infrastructure that can support institutional volumes while remaining accessible to retail participants. We are building a next-generation decentralized exchange with a fully on-chain order book. Our system is built with a custom state transition function and consensus layer, purpose-designed for high-performance, low-latency trading. The goal is to deliver a trustless platform that matches the speed and efficiency of traditional trading engines while providing full transparency by running execution as close as possible to the blockchain itself.

Position Overview

We are seeking a Senior Rust Backend Engineer experienced in building high-performance, reliable trading APIs (HTTP & WebSocket). You will be responsible for designing, implementing, and optimizing the backend services that power our exchange interfaces - ensuring low latency, resilience, and correctness under load.

You’ll work on high-throughput, real-time systems that handle order and trade data ingestion, manage live WebSocket feeds, and maintain internal state consistency from streaming market events. The ideal candidate is both a strong Rust engineer and a system thinker, capable of reasoning about concurrency, data flow, and observability in production environments.

This role offers an opportunity to shape the architecture of our trading backend at an early stage, working alongside a distributed team of seasoned engineers building next-generation financial infrastructure.

Key Responsibilities

• Own the architecture and technical direction of high-performance trading APIs (HTTP & WebSocket) supporting low-latency order entry, market data distribution, and account state updates.
• Lead the design and implementation of structured concurrency using the Tokio runtime, defining best practices for task lifecycle management, cancellation semantics, backpressure, and graceful degradation under load.
• Develop and maintain real-time state ingestion pipelines:
  • Process append-only logs (e.g., trades, order updates, book diffs).
  • Rebuild local states efficiently using snapshot + diff application.
• Model trading-related data structures, including orders, fills, trades, positions, funding, and liquidation logic.
• Implement WebSocket connection logic, including upgrade handling, frame parsing, and data fanout for subscribed clients.
• Design observable backend systems with rich metrics, structured logging, and distributed tracing for performance insights and failure analysis.
• Collaborate with system and infrastructure engineers to continuously improve performance, scalability, and fault tolerance.
• Write comprehensive unit, integration, and load tests to ensure stability under production conditions.

Requirements

Rust Expertise

• 5+ years of professional backend engineering experience, with 3+ years of Rust in production.
  • Strong experience with the Tokio async runtime and concurrent programming patterns.
  • Deep understanding of structured concurrency and robust handling of spawned task cancellation.
  • Hands-on experience with HTTP and WebSocket frameworks such as Hyper or similar.

Trading Literacy

• Solid understanding of CEX/DEX systems and trading models.
• Familiarity with data modeling for trading entities (orders, trades, positions, funding, mark price, margin, liquidation logic, etc.).
• Prior hands-on trading or market data experience (personal or professional).

State Ingestion & Processing

• Expertise in real-time data streaming and processing systems.
• Ability to design systems that rebuild local state efficiently from snapshots and diffs.
• Familiarity with replay, recovery, and correctness guarantees in event-driven systems.

WebSocket Engineering

• Understanding of connection upgrades, frame parsing, and data fanout for subscribed clients.

Observability Engineering

• Ability to design and instrument systems for metrics, logging, and tracing.
• Experience with Prometheus and OpenTelemetry in production.
• Track record of diagnosing and resolving performance bottlenecks and production incidents.

Big Bonus

Performance Engineering

• Deep understanding of lock-free or lock-avoidant data structures
• Experience designing cache-friendly data layouts and optimizing for memory locality in latency-sensitive systems.
• Proficiency in profiling CPU and memory performance and able to diagnose and optimize latencies in real-time event pipelines

DevOps & CI/CD

• Familiarity with Docker-based environments and CI/CD pipelines.

Why Join Us

• Work on cutting-edge trading infrastructure bridging traditional and decentralized finance.
• Collaborate with a world-class, distributed engineering team.
• Influence critical technical decisions from the early stages.
• Competitive compensation and growth opportunities in a rapidly evolving space.