Staff Product Security Engineer

Phantom
Staff Product Security Engineer (Security)
Формат работы: удалённо

Чем предстоит заниматься
-Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services
-Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations
-Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation
-Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production
-Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed
-Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows
-Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation
-Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards
-Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team

Наши пожелания к кандидатам
-5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level
-Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes
-Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation
-Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go
-Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity
-Experience threat modeling complex products and translating security risks into concrete engineering requirements
-Strong judgment when evaluating exploitability, business impact, and appropriate remediation
-Track record of partnering effectively with engineering and product teams while maintaining a high security bar
-Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders

Откликнуться

Подписаться на наши каналы / [контакты и ссылка отклика — после бесплатной регистрации] / [контакты и ссылка отклика — после бесплатной регистрации]