Senior Officer - Digital Assets & Application Security

About the role

Zand Bank protects its digital-asset and Web3-enabled services by securing the technology behind them, from web and mobile applications, APIs and cloud infrastructure to wallets, cryptographic keys and smart contracts. The role combines hands-on Web3 expertise with strong application security capabilities and strengthens security and privacy across digital-asset initiatives and the bank's wider application portfolio.

Key responsibilities

• Conduct threat modelling and security architecture reviews across web, mobile, API and cloud applications, blockchain platforms, dApps, wallets, custody solutions, bridges and oracle integrations.
• Embed security in development and CI/CD pipelines through SAST, DAST, software composition analysis, secrets scanning and supply-chain controls.
• Review application, API, mobile and smart-contract security assessments, penetration tests, code reviews and audits, applying OWASP standards.
• Assess identity and access controls, including IAM, privileged access, MFA, session management and token security.
• Triage and risk-rate vulnerabilities, track remediation and validate fixes for application flaws, smart-contract weaknesses, exposed secrets, wallet issues and transaction-signing risks.
• Establish secure cryptographic key management, including multi-signature arrangements and hardware security modules.
• Enforce hardening of blockchain nodes, RPC endpoints, indexing services, repositories and cloud infrastructure.
• Apply pre-deployment security gates for smart contracts, including audit sign-off, upgradeability controls, time locks and emergency pause mechanisms.
• Monitor emerging Web3 threats and support incident response, tabletop exercises and playbooks for compromised keys, unauthorized transactions and smart-contract exploits.
• Assure custody providers, wallet platforms, node/RPC providers, oracles and audit firms, and partner with the Data Privacy team on blockchain-related privacy risks.
• Maintain risk registers, control evidence and audit-ready records, and report security metrics to management and the Information Security Committee.

Required profile

• Bachelor's degree in Cybersecurity, IT, Computer Science, Engineering or a related discipline; equivalent experience may be considered.
• 5+ years in information security, cybersecurity, IT risk, application or cloud security.
• 2+ years of hands-on blockchain, digital assets, smart contracts, dApps, wallet security or Web3 infrastructure experience.
• At least 3 years of hands-on application, API or cloud security experience.

Required skills

• Strong knowledge of blockchain and Web3 fundamentals, including public/private keys, transaction signing, consensus mechanisms, wallets and token standards.
• Experience reviewing smart contracts or working with external audit firms, including reentrancy, oracle risks, front-running/MEV and bridge vulnerabilities.
• Hands-on application security with Burp Suite, SAST/DAST and cloud security posture management, supported by secure SDLC and DevSecOps.
• Knowledge of cryptography, IAM, custody platforms, multi-signature and hardware wallets, HSMs and key management.
• Preferred: CISSP, OSCP/OSWE, GWAPT, CCSP or AWS/Azure certifications; desirable: CCSSA or CBSP.