Information Security Engineer

Tower Research Capital is a leading quantitative trading firm founded in 1998. Tower has built its business on a high-performance platform and independent trading teams. We have a 25+ year track record of innovation and a reputation  for discovering unique market opportunities.Tower is home to some of the world’s best systematic trading and engineering talent. We empower portfolio managers to build their teams and strategies independently while providing the economies of scale that come from a large, global organization. 

Engineers thrive at Tower while developing electronic trading infrastructure at a world class level. Our engineers solve challenging problems in the realms of low-latency programming, FPGA technology, hardware acceleration and machine learning. Our ongoing investment in top engineering talent and technology ensures our platform remains unmatched in terms of functionality, scalability and performance.

At Tower, every employee plays a role in our success. Our Business Support teams are essential to building and maintaining the platform that powers everything we do — combining market access, data, compute, and research infrastructure with risk management, compliance, and a full suite of business services. Our Business Support teams enable our trading and engineering teams to perform at their best.

At Tower, employees will find a stimulating, results-oriented environment where highly intelligent and motivated colleagues inspire each other to reach their greatest potential.

Position Overview

We’re looking for a hands-on Information Security Engineer who can own the design, build-out, support, and continuous improvement of our security stack across cloud, on-prem, and crypto environments. You’ll partner with engineering, DevOps, and product teams to embed security into every layer of our infrastructure—from Kubernetes clusters and CI/CD pipelines to crypto wallet transfer security.

Responsibilities

Security Engineering & Automation

• Designing and implementing automated detection & response tooling in Python/Bash

• Building security guardrails into CI/CD pipelines (e.g., IaC scanning, SAST/DAST, SBOM validation)

Infrastructure & Cloud Security

• Operating and extending Zero-Trust controls (ZTA, micro-segmentation, policy as code) , HashiCorp Vault, IAM, EDR/XDR, DLP, SIEM/SOAR, and CSPM tooling

• Driving threat-modeling and secure-architecture reviews for new and existing services

Crypto / DeFi Security

• Assessing and monitoring cryptocurrency trading processes, wallet transfers, and custody solutions

• Implementing secure key rotation and wallet-monitoring controls

Threat & Vulnerability Management

• Conducting threat hunting, detection-rule development, and continuous control validation, tuning lessons learned into improved controls

• Producing actionable remediation guidance and track it to closure

Mentorship & Governance

• Championing adherence to NIST CSF, CIS Benchmarks, and relevant regulatory requirements

• Maintaining security runbooks, diagrams, and Confluence knowledge bases

Qualifications

• Bachelor’s or Master’s in Computer Science, Cybersecurity, or closely related field (or equivalent experience)
• At least 5 years of experience in cybersecurity engineering/operations within enterprise or high-growth fintech environments
• Excels in Unix/Linux, network-level troubleshooting, and secure-by-default infrastructure design
• Strong programming / scripting ability (Python mandatory); Bash a plus)
• Deep knowledge of MITRE ATT&CK, purple-team methodologies, and threat-intelligence lifecycle
• Experience with at least 3 of the following security domains:
• Cloud security architecture (AWS/GCP/Azure) & Kubernetes hardening
• SIEM/SOAR rule-writing, threat hunting, and detection engineering
• HashiCorp Vault, Secrets Managers, or KMS/HSM integrations
• EDR/XDR deployment and tuning (SentinelOne, CrowdStrike, etc.)
• DeFi / blockchain threat modeling, smart-contract assessment, MPC key management
• Secure SDLC, code-review, IaC (Terraform, Pulumi), and pipeline security
• Familiarity with common exploit techniques (web, mobile, network, container, serverless) and reverse engineering basics
• Proven track record writing clean documentation and presenting complex findings to both technical and executive stakeholders

Preferred Qualifications 

• Relevant certifications a plus (e.g., GIAC GCSA, OSWE, GCPN, CKS, CRT, or Certified Blockchain Security Professional)
• Familiarity with compliance frameworks such as SOC 2, ISO 27001, NYDFS 500, or MAS TRM
• Open-source contributor to security tooling or threat-intelligence feeds

Benefits

Tower’s headquarters are in the historic Equitable Building, right in the heart of NYC’s Financial District and our impact is global, with over a dozen offices around the world. 

At Tower, we believe work should be both challenging and enjoyable. That is why we foster a culture where smart, driven people thrive – without the egos. Our open concept workplace, casual dress code, and well-stocked kitchens reflect the value we place on a friendly, collaborative environment where everyone is respected, and great ideas win.

Our benefits include:

• Generous paid time off policies
• Savings plans and other financial wellness tools available in each region
• Hybrid working opportunities
• Free breakfast, lunch and snacks daily 
• In-office wellness experiences and reimbursement for select wellness expenses (e.g., gym, personal training and more) 
• Company-sponsored sports teams and fitness events (JPM Corporate Challenge, Cycle for Survival, Wall Street Rides FAR and more)
• Volunteer opportunities and charitable giving 
• Social events, happy hours, treats and celebrations throughout the year
• Workshops and continuous learning opportunities

At Tower, you’ll find a collaborative and welcoming culture, a diverse team and a workplace that values both performance and enjoyment. No unnecessary hierarchy. No ego. Just great people doing great work – together.

Tower Research Capital is an equal opportunity employer.