Security Architect for Self‑Custody Crypto Wallet

About the role

ITRex is seeking a Security Architect to own security and privacy assurance for a self‑custody crypto wallet during its first delivery phase. The wallet runs on users' devices, so any defect in the signing path cannot be fixed server‑side. You will work closely with SDK, backend, mobile, DevOps, and QA teams and act as the technical counterpart to the independent auditor.

Key responsibilities

• Be the single technical owner of security and privacy for the crypto wallet.
• Collaborate daily with wallet SDK integration, backend, mobile, DevOps, and QA engineers.
• Co‑sign the exit checklist for every milestone.
• Provide technical guidance to the client‑engaged independent auditor.
• Continuously monitor, detect, and respond to security incidents.

Required profile

• Strong experience in mobile and application security (iOS, Android).
• Deep knowledge of applied cryptography and digital‑asset security.
• Hands‑on expertise with backend and cloud security, especially AWS.
• Proficiency in secure SDLC, supply‑chain security, and compliance engineering.
• Excellent written communication for auditors, legal counsel, and non‑technical stakeholders; English at C1 level.

Required skills

• iOS Secure Enclave, Android Keystore/StrongBox, biometric APIs, platform attestation.
• RASP, anti‑tamper, certificate pinning, Frida, objection, MobSF.
• BIP‑32, BIP‑39, BIP‑44, ECDSA secp256k1, AES‑GCM, modern KDFs, envelope encryption, KMS, HSM, key rotation.
• AWS IAM, KMS, VPC, CloudTrail, GuardDuty.
• OAuth 2.0, OIDC, JWT, JWKS, WebAuthn, session/device binding, API authorisation, rate limiting, secure service‑to‑service design.
• Threat modelling, secure code review, SAST, DAST, SCA, SBOM, secret scanning, CI/CD hardening.
• EVM transaction structure, ERC‑20, ERC‑4337, smart‑account wallets, address‑poisoning, RPC provider trust.
• Sanctions screening, KYC/CDD, Travel Rule data model, audit logging, ISO/IEC 27001, SOC 2, NIST CSF.
• Incident detection, severity triage, on‑call practice, post‑mortem discipline.