Staff Product Security Engineer (Security)

#senior #удаленка Phantom Staff Product Security Engineer (Security) Формат работы: удалённо ☑️ Чем предстоит заниматься -Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services -Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations -Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation -Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production -Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed -Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows -Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation -Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards -Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team ☑️ Наши пожелания к кандидатам -5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level -Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes -Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation -Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go -Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity -Experience threat modeling complex products and translating security risks into concrete engineering requirements -Strong judgment when evaluating exploitability, business impact, and appropriate remediation -Track record of partnering effectively with engineering and product teams while maintaining a high security bar -Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders