Vice President, Senior Product Security Engineer

Onsite

Mumbai, Maharashtra, IndiaPosted 4 months agoWebsite

Apply on LinkedIn →

At a Glance

Threat ModelingSASTDASTSCACS/Security Degree

About This Role

Galaxy is seeking a Senior Product Security Engineer with an expertise in securing micro services and cloud applications, and with a thorough understanding of product and software engineering processes. The engineer will participate in assessments of advanced trading systems and blockchain architectures, followed by the facilitation and/or implementation of remediations. The engineer will report to the Director of Product Security and work closely with Engineering, Product and Infrastructure teams to design and deliver secure software solutions at a rapid growth company.

Responsibilities

Participate in relevant secure software design and code reviews
Assist with development and review of test plans to ensure effective security coverage
Assist teams with the mitigation of findings: assess the impacts, propose possible solutions, and provide technical guidance for implementation
Provide expertise and advice on cloud application and infrastructure security design patterns
Provide training and thought leadership for secure software development practices
Review and improve implementations of authentication, authorization, data access and other security layers of our product stack
Research and collaborate with product team members to make proposals to adopt advanced security patterns - e.g. MPC, multi-signature, confidential computing

Requirements

SASTDASTSCA

Bachelor or post-graduate diploma in cybersecurity or technology
5 years work experience in product security, application security, cloud security, or software development of security features
Threat modeling, risk assessment, controls review
Programming languages
Managing SAST, DAST, SCA, and helping software engineers with understanding vulnerabilities and selecting appropriate mitigation
In depth understanding of at least a few of the following topics: authentication and authorization technology, TLS and PKI, network security, cloud security, system security
Strong analysis skills, detail oriented, strategic thinking
Strong verbal and written communication skills, collaborative and solution-driven
Security or cloud certifications

Benefits & Perks

Competitive base salary and discretionary bonus

Competitive paid time off

Great office location in central Mumbai (BKC)

Company-paid health and protective benefits for employees and their eligible dependents

Free virtual coaching sessions through Headspace

Opportunities to learn about the Crypto industry

Smart, entrepreneurial, and fun colleagues

About Galaxy

Galaxy is a global financial services firm based in New York City, specializing in digital assets and data center infrastructure. Founded in 2018 by Michael Novogratz, the company operates through two main segments: Digital Assets and Data Centers. It provides institutional-grade solutions that connect traditional finance with blockchain, cryptocurrency, and artificial intelligence. The Digital Assets Platform offers a range of services, including trading, lending, derivatives, staking, asset management, and advisory services. Galaxy also develops and operates data centers focused on high-performance computing (HPC) and AI workloads, addressing the growing demand for scalable energy and compute solutions. Recently, Galaxy launched GalaxyOne, a platform for individual U.S. investors, providing opportunities for cash yields and trading in crypto and equities. The firm emphasizes regulated and scalable solutions for both institutional and retail clients.

Industry

financial services

Employees

530

140 engineers

Revenue

$1.2B

Website

Visit →

Security at Galaxy

Compiled from public job postings, careers pages, and company materials. Data may not reflect current state — verify during interviews.

3 Intel Signals

Security Philosophy

Galaxy's AppSec philosophy prioritizes building products and services securely by design and integrating security into the software engineering lifecycle.
Their culture emphasizes being 'Highly Aligned, Loosely Coupled'.
They aim to enable developers by providing training and thought leadership for secure software development practices, assisting teams with mitigation, and helping engineers understand vulnerabilities.
Their risk philosophy includes threat modeling, risk assessment, and controls review, with a focus on ensuring technology teams adhere to SLAs for vulnerability triage and remediation.

Security Team

Galaxy's AppSec team roles 'report to the Director of Product Security' or 'reports directly to the Director of Product Security'. Public-facing leader names (top 1–3) are not publicly available, as no named Director of Product Security or ProdSec leader was found. Team size estimate is also not publicly available. As of, there are 3 active AppSec job postings: Director, Product Security; VP / Senior Product Security Engineer; and Associate Security Engineer (Vulnerability Management). Common skills and tools called out in postings include 'Managing SAST, DAST, SCA', scripting/programming, cloud security patterns, threat modeling, and 'Leverage AI-driven tools for efficient data analysis'.

Key Initiatives

Evidence suggests a security champions or guild model, with postings including 'Develop a cadre of primary contacts with associated cyber security interests across the engineering team following a guild or practice model'. Shift-left practices are evident, as roles require participation 'throughout the software lifecycle' and to 'integrate security into the software engineering lifecycle'. The vulnerability management process involves tracking and reporting remediation progress, and coordinating with engineering teams to validate, assign, and prioritize vulnerabilities. Intake sources mentioned include SAST/DAST/SCA and 'Bug Bounty programs'. SLAs are required for vulnerability triage and remediation. Secure SDLC artifacts include participation in 'design and code reviews' and assisting with 'development and review of test plans'. Recent initiatives (last 6 months) are not publicly available.

Preparing for an AppSec interview?

Get the weekly briefing 2,000+ security pros trust.

Interested in this role?

Apply on LinkedIn