Agora - Senior Security Engineer

📋 Job Overview

At Agora, our mission is to transform how money moves. We believe stablecoins will underpin a new financial fabric, one that is faster, more global, and more efficient than today's siloed systems. That is why we are building AUSD and the Agora stack, a full service platform that makes issuing, managing, and integrating stablecoins seamless, whether you're a developer, fintech, or institution. With AUSD, stablecoins become programmable, composable, and ubiquitous by default. We believe digital dollars should be a public good: trusted, accessible, and built for real-world utility. Our mission is to drive adoption through customizable, user-friendly on-ramps that make stable, dollar-based value available onchain. We're backed by world-class investors including Paradigm and Dragonfly, and we're growing a team to reimagine how value moves online. We're intentional about who we bring on. If you're passionate about security and want to help us build a safe environment for people to engage with money, let's talk.

🏢 About Agora

Agora combines the discipline required to operate financial infrastructure with the pace and creativity of a crypto-native startup. We are a small, mission-driven team that values clear thinking, extreme ownership, attention to detail, and high-velocity decision-making. The Security team works directly with Engineering, Product, Infrastructure, Compliance, and Operations to manage risk without creating unnecessary friction. We operate in short feedback loops and expect security engineers to understand systems deeply, make pragmatic decisions, and help teams ship securely.

🎯 The Role

We are looking for a Senior Security Engineer to help secure the products and services Agora builds and operates. You will be the Security team's primary technical partner to Engineering. You will work alongside engineers from initial design through production operation: building and reviewing controls, architectures, code, infrastructure, and configuration; identifying meaningful risks; and helping teams implement practical solutions. You will also play a hands-on role in Agora's security monitoring program. You will identify the telemetry and detections needed to protect our systems, implement and tune alert rules, investigate security events, and work closely with our SOC and internal teams during incident response. This is a broad ownership role. You should be equally comfortable reviewing an API authorization model, reasoning about an AWS or Kubernetes deployment, tuning a security scanner, investigating suspicious production activity, and driving a vulnerability through remediation. Agora's environment includes TypeScript and Node.js services, React applications, REST APIs, relational databases, Docker, Kubernetes on AWS, Pulumi infrastructure as code, Argo CD and GitOps, Cloudflare, and blockchain infrastructure. You do not need to arrive as an expert in every part of the stack, but you should be able to learn unfamiliar systems quickly and evaluate them from first principles. We prefer candidates located close to Eastern Time, while welcoming exceptional engineers across Pacific Time through ET+2. Regardless of where you are located, your working hours will need to have a majority overlap with ET business hours.

✅ Key Responsibilities

• Partner with Engineering and Product throughout the development lifecycle, from early design and threat modeling through launch and ongoing operation.
• Perform security reviews of system designs, application code, APIs, infrastructure as code, cloud environments, Kubernetes workloads, deployment pipelines, and production configurations.
• Identify vulnerabilities and design weaknesses, communicate their impact clearly, and work with engineers on pragmatic remediation.
• Serve as a trusted security subject-matter expert for application security, cloud and container security, identity and access management, secrets management, API security, data protection, and secure software development.
• Develop reusable security guidance, secure patterns, review checklists, and engineering standards that make the secure approach easier to adopt.
• Administer and improve Agora's security tooling, including AI-assisted security tools, SAST, DAST, software composition analysis, container and infrastructure-as-code scanning, CSPM, security monitoring, and related capabilities.
• Integrate security controls into developer workflows and CI/CD pipelines; tune rules, reduce noise, improve coverage, and ensure findings lead to action.
• Translate threat models and known attack paths into concrete logging, monitoring, and detection requirements.
• Identify gaps in application, cloud, identity, infrastructure, and blockchain-related security telemetry, then work with engineering teams to address them.
• Design, implement, test, document, and tune security alert rules and detection logic.
• Triage and investigate security detections, correlate activity across relevant data sources, and determine scope, impact, severity, and required response.
• Work closely with Agora's SOC to improve alert quality, escalation criteria, investigation procedures, and response runbooks.
• Participate in security incident response, including investigation, containment, eradication, recovery, stakeholder coordination, and evidence preservation.
• Lead or contribute to post-incident reviews and ensure lessons learned result in durable improvements to architecture, controls, monitoring, and operational processes.
• Own the day-to-day execution of the vulnerability management program, including intake, validation, risk-based prioritization, assignment, remediation tracking, exception management, verification, and reporting.
• Support third-party penetration tests, code reviews, architecture assessments

🎁 Benefits

Compensation: $150K – $200K • Offers Equity • Offers Bonus

🛂 Visa & Eligibility

We prefer candidates located close to Eastern Time, while welcoming exceptional engineers across Pacific Time through ET+2. Regardless of where you are located, your working hours will need to have a majority overlap with ET business hours.