---
title: 'Principal Security Engineer (Crypto / Digital Assets) at capital.com'
canonical: 'https://feeny.ai/job/principal-security-engineer-crypto-digital-assets-capital-com-dubai-dev6z2b42jp9'
type: 'job'
last_seen: '2026-09-10'
---

# Principal Security Engineer (Crypto / Digital Assets) at capital.com

- **Company:** capital.com
- **Location:** Dubai, United Arab Emirates
- **Work type:** hybrid
- **Posted:** 2026-07-27
- **Last confirmed live:** 2026-09-10
- **Apply:** https://jobs.lever.co/capital/6e41db67-c955-4c6f-ae12-9a989c46e283

## Job description

We are looking for a Principal Security Engineer with deep crypto domain expertise to lead security across our regulated digital-asset business. As we build out spot trading, custody, staking and on-chain services for our client base, security is the foundation the whole business stands on. This role owns it.

You will be the security owner for our crypto platform's custody and on-chain layer end to end: architecture, engineering, operations and regulatory assurance for the parts of the stack that are unique to digital assets. For platform capabilities already owned by central security teams (cloud, application security, IAM, SOC), you'll define the crypto-specific requirements and partner on delivery rather than duplicate ownership. You will work closely with risk, compliance, product and engineering, and report into the central security function.

This is a hands-on senior role for someone who understands that in digital-asset custody, a single key-management failure is a firm-ending event, and who builds controls accordingly.

Key Responsibilities: Digital asset and custody security (owned by this role):

- Own the full custody stack: MPC key management, transaction authorisation, signing quorums, address whitelisting and withdrawal controls
- Govern hot/cold wallet segregation, key ceremonies and delegated cold custodians
- Secure staking architecture and on-chain deposit/withdrawal paths

Platform, cloud and application security (partner with InfraSec, AppSec and IAM):

- Define crypto-specific hardening requirements for the custody and exchange stack within the existing multi-account AWS environment; partner with InfraSec on account segmentation, network and data-residency controls
- Partner with AppSec to embed crypto-specific checks into the SDLC (SAST, DAST, SCA, CI/CD security gates) for custody and exchange services
- Partner with IAM and IAM Tech on privileged access and secrets governance for crypto signing keys and custody credentials

Threat detection, response and testing (partner with SOC, CorpSec and AppSec):

- Define custody- and blockchain-specific detection use cases and feed them into SOC's monitoring and alerting
- Own incident response for crypto-specific scenarios (key compromise, unauthorised transaction, on-chain incident); partner with CorpSec on the group-wide IR process, forensics and breach notification
- Contribute custody- and blockchain-specific scenarios into AppSec's pentest and red-team programme

Third-party and vendor security (own crypto vendor risk, partner with CorpSec on process):

- Own security assessment and ongoing assurance of the crypto vendor stack: custody platforms, execution systems, blockchain analytics, Travel Rule and treasury tooling
- Apply CorpSec's vendor onboarding and contract security process to crypto vendor engagements

Regulatory, resilience and governance (own crypto-specific mapping, partner with IT Governance):

- Own control mapping against MiCA and the crypto-specific provisions of DORA and FCA rules; partner with IT Governance on ISO 27001, SOC 2, NIST CSF and GDPR mapping
- Feed crypto services into the group's BC/DR and important-business-service mapping owned by IT Governance
- Maintain crypto-specific security policy addenda; support regulatory and IT audits on crypto scope

Required Qualifications:

- 6+ years in information security, including recent experience as a senior security engineer, security architect, or security lead;
- Direct experience securing crypto, digital-asset custody, or a regulated financial platform; strong understanding of blockchain security, wallet architecture and key management;
- Working knowledge of cloud security fundamentals (AWS preferred, Azure/GCP acceptable) in a regulated environment;
- Practical knowledge of security in regulated finance and how controls map to licence conditions (ISO 27001, SOC 2, NIST);
- Experience running threat modelling, risk assessments and incident response;
- Comfortable operating in a matrixed security model - partnering with dedicated IAM, AppSec, SOC and infrastructure security teams rather than owning those functions outright.

Nice to have:

- Hands-on Kubernetes, containers, API security and infrastructure as code;
- Python proficiency for automation and scripting;
- Experience running third-party / vendor security assurance;
- Recognised certifications: CISSP, CISM, CCSP, or equivalent;
- Hands-on experience with MPC - based custody, key ceremonies and signing-policy design;
- Familiarity with MiCA, DORA, FCA crypto rules, or comparable digital-asset regimes;
- Background in secure SDLC and DevSecOps (OWASP, secure-by-design);
- Experience with smart contract security review: threat modelling, commissioning and managing external audits, and driving findings through to resolution;
- Experience designing transaction signing and approval flows, so that what a user or operator authorises is provably what gets signed and broadcast;
- Experience reviewing business logic in the money path - withdrawal sequencing, balance idempotency, internal ledger integrity - where the flaw sits in the logic rather than the cryptography;
- Familiarity with supply-chain assurance for crypto-specific dependencies: wallet SDKs, chain libraries, node clients and signing tooling, including pinning, provenance and upgrade discipline;
- Experience defining bug bounty scope for crypto assets, and triaging and calibrating severity for on-chain findings.

Soft Skills:

- Strong analytical and problem-solving skills;
- Able to translate technical risk into business and regulatory impact;
- Able to explain security risks and mitigations to non-security teams and to regulators;
- Cross-functional collaboration with risk, compliance, product and engineering teams;
- Clear documentation and communication skills.

What You Will Get in Return:

- Competitive Salary: We believe great work deserves great pay. Your skills and talents will be rewarded with a salary that makes you feel valued and motivated.
- Work-Life Harmony: Join a company that genuinely cares about you, because your life outside of work matters just as much as your time on the clock. #LI-Hybrid
- Generous Time Off: Need a breather? Our annual leave policy lets you recharge and enjoy life outside of work without a worry.
- Employee Referral Program: Love working here? Share the love. Bring your talented friends on board and get rewarded for growing our team.
- Comprehensive Health & Pension Benefits: From medical insurance to pension plans, we’ve got your back. Plus location-specific benefits and perks.
- Workation Wonderland: Live your digital nomad dreams with 30 extra days to work remotely from anywhere in the world (some restrictions apply).
- Volunteer Days: Take two additional paid days each year to support causes you care about and give back to the community.

Be a key player at the forefront of the digital assets movement, propelling your career to new heights. Join a dynamic and rapidly expanding company that values and rewards talent, initiative and creativity. Work alongside one of the most brilliant teams in the industry.

## About capital.com

## Company Overview
- **One-liner**: Capital.com is a multi-award-winning, tech-driven online trading platform that empowers retail traders worldwide with CFDs, advanced tools, and educational resources.
- **Entity Type**: Private (Series A, $25M funding from VP Capital in 2017)
- **Headquarters**: Limassol, Cyprus (with offices in London, Dubai, Warsaw, Sofia, Melbourne)
- **Founded**: 2016
- **Founders**: Viktor Prokopenya

## Core Business
- **Primary industry/industries**: Financial Services (Online Brokerage, CFD Trading, Fintech)
- **Target customers**: B2C (retail traders, from beginners to experienced)
- **Mission or purpose statement**: To help traders make better decisions by giving them the tools and resources they need to trade with confidence.

## Products & Services
- **[Capital.com Platform]**: Web and mobile trading platform offering 5,500+ markets across multiple asset classes (forex, indices, shares, commodities, crypto). Features real-time data, advanced charting, and a responsive mobile app. (SaaS, mobile-first)
- **[Investmate App]**: Educational app for new and amateur traders, covering finance basics, risk management, and trading skills. (Service / Education)
- **[eQ (AI-Powered Trading Bias Detection)]**: A system that tracks trading behaviour, detects cognitive biases, and provides personalised educational materials and news. (AI tool)
- **[SmartFeed]**: A feed that delivers personalised financial news and educational content based on user behaviour. (AI-powered content engine)

## Market Standing
- **Valuation/Market Cap**: Not disclosed
- **Key Metric**: Total client trading volume exceeded $1.2 trillion in 2023; over 880,000 traders; 1,000+ employees globally as of 2025.
- **Notable Investors/Partners**: VP Capital (lead investor); regulated by FCA (UK), CySEC (Cyprus), ASIC (Australia), SCA (UAE) and in other jurisdictions.
- **Growth Signals**: 34% year-over-year headcount growth (adding ~326 people); named "Fastest-Growing Company in the Middle East and Cyprus" for three consecutive years; expanded into UAE with a new regional head office; trading volumes grew 90% YoY in 2022; awarded "best in class" in five categories by ForexBrokers.com in 2024.

## Competitive Advantages
- **AI-first approach**: Proprietary behavioural analytics (eQ, SmartFeed) that help traders improve decision-making – a key differentiator from traditional brokers.
- **Global regulatory footprint**: Licensed in five major jurisdictions, providing trust and access to clients in 180+ countries.
- **Mobile-first from inception**: Launched as the first mobile-first broker in Europe, leading to a seamless cross-device experience.
- **Strong brand recognition**: Multi-award-winning with high ratings on Glassdoor (4.5) and among clients.

## Strategic Focus
- Continue expanding into new markets (e.g., UAE, Asia-Pacific).
- Deepen AI and machine learning capabilities to enhance personalisation and trading insights.
- Scale the educational ecosystem (Investmate, SmartFeed) to attract and retain retail traders.
- Grow headcount across engineering, product, and operations teams while maintaining a strong culture.

## Why Work Here
- **Culture**: Values-driven (ownership, curiosity, momentum) with a collaborative, international environment. Described as blending "the ambition of a scale-up with the collaboration of a close-knit team."
- **Work Model**: Hybrid working (where applicable); option to work abroad up to 30 days per year ("Workation Initiative").
- **Perks**: Private health insurance, performance-based bonuses, volunteering days, referral bonuses, social events, development and training support.
- **Engineering & Innovation**: Opportunity to work on a next-generation trading platform using AI, data, and scalable infrastructure. Teams are located across multiple continents, offering cross-cultural collaboration.
- **Reviews**: Glassdoor score 4.5; LinkedIn employer rating 4.3/5.0 (246 reviews) with high marks for Work-Life (4.4), Compensation (4.6), Culture (4.3), and Career (4.4).

## Sources
1. [careers.capital.com](https://careers.capital.com/)
2. [capital.com/en-gb/about-us/careers](https://capital.com/en-gb/about-us/careers)
3. [jobs.lever.co/capital](https://jobs.lever.co/capital)
4. [linkedin.com/company/capital.com](https://linkedin.com/company/capital.com)
5. [capital.com/en-int/about-us/our-history](https://capital.com/en-int/about-us/our-history)

## Other roles at capital.com

- [Marketing Manager (Gibraltar)](https://feeny.ai/job/marketing-manager-gibraltar-capital-com-gibraltar-nzp8nnh7p0hf) — Gibraltar
- [Senior Partnerships Manager](https://feeny.ai/job/senior-partnerships-manager-capital-com-dubai-6xdf448ywm2r) — Dubai, United Arab Emirates
- [IT Service Desk Engineer L1](https://feeny.ai/job/it-service-desk-engineer-l1-capital-com-warsaw-hy2wwjm7f3rv) — Warsaw, Poland
- [Senior Product Operations Manager – LLM Automation](https://feeny.ai/job/senior-product-operations-manager-llm-automation-capital-com-sofia-city-nt6jvk98nm04) — Sofia City, Bulgaria
- [New Business Specialist (Client Activation & Onboarding)](https://feeny.ai/job/new-business-specialist-client-activation-onboarding-capital-com-city-of-76d24bm50rkg) — City of Johannesburg, Gauteng
- [Junior Trader](https://feeny.ai/job/junior-trader-capital-com-limassol-tgmagg82fczr) — Limassol, Cyprus
- [Security Architect](https://feeny.ai/job/security-architect-capital-com-warsaw-yfk897303arg) — Warsaw, Poland
- [Head of Dealing](https://feeny.ai/job/head-of-dealing-capital-com-nassau-59vg14gm4n3s) — Nassau, New Providence
- [Country Manager, Brazil](https://feeny.ai/job/country-manager-brazil-capital-com-sao-paulo-z87vtdj4ybm5) — São Paulo, Brazil
- [Senior Zendesk Automation Specialist](https://feeny.ai/job/senior-zendesk-automation-specialist-capital-com-sofia-city-dm0z3a7qwzqx) — Sofia City, Bulgaria