Staff Product Security Engineer (Security)

☑️ Чем предстоит заниматься

• Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services
• Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations
• Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation
• Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production
• Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed
• Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows
• Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation
• Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards
• Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team

☑️ Наши пожелания к кандидатам

• 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level
• Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes
• Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation
• Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go
• Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity
• Experience threat modeling complex products and translating security risks into concrete engineering requirements
• Strong judgment when evaluating exploitability, business impact, and appropriate remediation
• Track record of partnering effectively with engineering and product teams while maintaining a high security bar
• Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders