Phantom - Staff Product Security Engineer (Security)
Requirements
• 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level. • Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes. • Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation. • Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go. • Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity. • Experience threat modeling complex products and translating security risks into concrete engineering requirements. • Strong judgment when evaluating exploitability, business impact, and appropriate remediation. • Track record of partnering effectively with engineering and product teams while maintaining a high security bar. • Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders. • Experience securing consumer financial products, wallets, payments, or other systems where client integrity and transaction safety are critical. • Familiarity with blockchain systems, smart-contract interactions, transaction simulation, signing workflows, or self-custodial wallet architecture. • Experience securing browser extensions or native mobile applications. • Experience building and integrating application-security tooling, static or dynamic analysis, security test infrastructure, or policy-as-code controls. • Familiarity with AWS, Kubernetes, CI/CD systems, and cloud-native service architectures. • Experience working with bug bounty programs or coordinating external security assessments.
Responsibilities
• Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services. • Product Security Ownership: • Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations. • Architecture and Threat Modeling: • Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation. • Secure Product Development: • Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production. • Code Review and Security Testing: • Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed. • Security Tooling: • Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows. • Software Supply Chain Security: • Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation. • Vulnerability Management: • Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards. • Incident Response: • Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team. • Technical Leadership:
Benefits
• Phantom is built by a team of experienced product and engineering leaders working to make crypto-powered finance safer and easier to use. Our products serve a large and rapidly growing global community, which makes security engineering here both technically challenging and directly consequential. • Eligibility to participate in the company’s performance bonus program • Comprehensive medical, dental, and vision insurance with 100% coverage • Stipend for your ideal remote setup • Flexible hours and a supportive remote environment • Unlimited vacation—take time when you need it • 401(k) retirement plan • Monthly wellness benefit • Weekly meal benefit • Global off-sites • The target base salary for this role will range between $200,000 to $250,000 with the addition of equity and benefits. This is determined by a few factors including your skillset, prior relevant experience, quality of interviews and market factors (such as location) at the point in time of offer. • We strongly encourage candidates of all backgrounds to apply. We believe that our work is stronger with a variety of perspectives, and we’re eager to further diversify our company. If you have a background that you feel would make an impact at Phantom, please consider applying. We’re committed to building an inclusive, supportive place for you to do the best work of your career. • We strongly encourage candidates of all backgrounds to apply. • By submitting your resume and application materials, you acknowledge and agree that Phantom Technologies, Inc. ("Phantom") collects and processes your personal information (including application materials, interview records, and related data) to evaluate your candidacy. Phantom may use AI-powered tools and third-party service providers for transcription, note-taking, scheduling, and other administrative tasks. Phantom does not sell your information and your materials will be handled securely and in accordance with applicable data protection laws.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT