Sr Officer Digital Assets & Application Security

Job Purpose Protect Zand Bank’s digital-asset and Web3-enabled services by securing the technology behind them—from web and mobile applications, APIs and cloud infrastructure to wallets, cryptographic keys and smart contracts. Combining hands-on Web3 expertise with strong application security capabilities, this role strengthens security and privacy across digital-asset initiatives and the Bank’s wider application portfolio. Key Responsibilities Conduct threat modelling and security architecture reviews across web, mobile, API and cloud applications, blockchain platforms, dApps, wallets, custody solutions, bridges and oracle integrations. Embed security into development and CI/CD pipelines through SAST, DAST, software composition analysis, secrets scanning, and dependency and software supply-chain controls. Coordinate and review application, API, mobile and smart-contract security assessments, penetration tests, code reviews and independent audits, applying relevant OWASP standards. Assess identity and access controls, including IAM, privileged access, multi-factor authentication, session management and token security across digital channels and administrative consoles. Triage and risk-rate vulnerabilities, track remediation against agreed timelines, and validate fixes for application flaws, smart-contract weaknesses, exposed secrets, wallet integration issues and transaction-signing risks. Establish secure cryptographic key-management practices covering generation, storage, rotation, recovery and signing, including multi-signature arrangements and hardware security modules. Review and enforce hardening of blockchain nodes, RPC endpoints, indexing services, repositories and cloud infrastructure. Apply pre-deployment security gates for smart contracts, including independent audit sign-off, upgradeability controls, administrative-key protection, time locks and emergency pause mechanisms. Track emerging Web3 threats and support monitoring of blockchain transactions, privileged wallet activity, abnormal fund movements and suspicious smart-contract interactions. Support incident-response planning, tabletop exercises, investigations, containment and recovery; maintain playbooks for compromised keys, unauthorized transactions, smart-contract exploits and third-party protocol incidents. Conduct security due diligence and ongoing assurance of custody providers, wallet platforms, node/RPC providers, oracles and smart-contract audit firms. Partner with the Data Privacy team to assess blockchain-related privacy risks, including wallet identifiers, decentralized identity, immutable records, public-ledger transparency and cross-border data transfers. Support security-by-design, privacy-by-design and compliance with applicable policies, regulatory obligations and industry standards; maintain risk registers, control evidence and audit-ready records, and report security metrics to management and the Information Security Committee. Key Skills, required Qualifications & Experience Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering or a related discipline; equivalent relevant experience may be considered. 5+ years of experience in information security, cybersecurity, IT risk, application security, cloud security or a related field, including: 2+ years of hands-on experience in blockchain, digital assets, smart contracts, dApps, wallet security or Web3 infrastructure. At least 3 years of hands-on experience in application, API or cloud security. Strong knowledge of blockchain and Web3 fundamentals, including public/private keys, transaction signing, consensus mechanisms, wallets, token standards and decentralized protocols. Experience reviewing smart contracts or working with external smart-contract audit firms, with knowledge of reentrancy, access-control flaws, integer and logic errors, oracle risks, front-running/MEV and bridge vulnerabilities. Experience with Solidity/EVM, Foundry/Hardhat and security tools such as Slither, Echidna, Mythril and Tenderly; familiarity with Rust is an advantage. Hands-on application security capabilities using tools such as Burp Suite, SAST/DAST and cloud security posture management, supported by knowledge of secure SDLC and DevSecOps practices. Experience conducting or supporting threat modelling, penetration testing, security architecture reviews and technology risk assessments. Strong understanding of cryptography, identity and access management, custody platforms, multi-signature and hardware wallets, hardware security modules and key-management systems. Knowledge of network technologies and segregation, vulnerability management, security monitoring, incident response and third-party security risk. Understanding of data governance, protection and privacy requirements, including the implications of handling personal data in blockchain-based systems. Familiarity with ISO 27001, NIST Cybersecurity Framework, NIST Privacy Framework, OWASP and SOC 2. Preferred Web2 certifications: CISSP, OSCP/OSWE, GWAPT, CSSLP, CCSP or AWS/Azure security certifications. Desirable Web3 certifications: Cryptocurrency Security Standard Auditor (CCSSA) or Certified Blockchain Security Professional. Show more Show less