Information Security (Stablecoin & Payment)

About the role

AX Coin is the first licensed stablecoin issuer regulated by the Central Bank of Bahrain. The company seeks a hands‑on Information Security professional to design, build, and operate a robust security framework across its blockchain infrastructure, stablecoin platform, and payment systems.

Key responsibilities

• Lead the security strategy and regulatory governance for the stablecoin business, including ISO 27001, SOC 1/2 Type II, and NIST framework implementation.
• Design and manage enterprise‑grade key management using HSM and MPC, covering the full lifecycle of cold, warm, and hot wallets.
• Establish a secure SDLC for smart contracts, conduct third‑party code audits, and develop real‑time risk controls against re‑entrancy, flash‑loan, and oracle attacks.
• Build and harden blockchain node clusters to resist DDoS, eclipse, and consensus‑layer attacks.
• Own end‑to‑end security architecture for cloud, applications, and infrastructure, integrating security into CI/CD pipelines with automated SAST/DAST, container signing, and vulnerability detection.
• Deploy on‑chain forensics tools for real‑time anomalous transaction monitoring and enforce OFAC‑sanctioned address blocking.
• Assess and secure cross‑chain bridge deployments, including third‑party risk assessments and whitelist management.

Required profile

• Proven experience securing large‑scale digital‑asset platforms and stablecoin ecosystems.
• Hands‑on builder mindset; able to write proof‑of‑concept exploits and remediate findings.
• Strong understanding of regulatory requirements for stablecoins and payment systems.
• Ability to communicate security posture to board members and regulators.

Required skills

• ISO 27001, SOC 1/2 Type II, NIST frameworks
• Hardware Security Modules (HSM) and Multi‑Party Computation (MPC)
• Smart contract security, code audit tools, and SDLC integration
• Blockchain node hardening, DDoS and eclipse attack mitigation
• Cloud security architecture (AWS/Azure/GCP)
• DevSecOps, CI/CD pipelines, SAST, DAST, container image signing
• On‑chain forensics and transaction monitoring tools
• Cross‑chain bridge security assessment