Phantom is hiring a Staff Product Security Engineer
Responsibilities
Product Security Ownership: partner with engineering teams to identify and address security risks across Phantom's mobile applications, web products, APIs, and backend services
Architecture and Threat Modeling: lead security reviews for new products and major architectural changes, with attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations
Secure Product Development: embed practical security controls into the software development lifecycle
Code Review and Security Testing: perform AI-assisted security code reviews and targeted testing of high-risk features
Security Tooling: develop and improve tooling that gives engineers fast, actionable security feedback
Software Supply Chain Security: harden CI/CD, build, and release systems against supply chain threats
Vulnerability Management: triage findings from internal testing, researchers, bug bounty, and third-party assessments
Incident Response: support investigation of product security incidents and suspicious activity
Technical Leadership: establish product security patterns and expectations across engineering
Requirements
5+ years of experience in product security, application security, security engineering, or software engineering, including senior or staff level
Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes
Hands-on experience building or applying AI-assisted security tooling
Ability to review production code in TypeScript, JavaScript, Rust, Python, and Go
Experience securing software supply chains and CI/CD systems
Experience threat modeling complex products
Strong judgment when evaluating exploitability, business impact, and remediation
Track record of partnering effectively with engineering and product teams