Staff Product Security Engineer, Phantom

• We’re looking for strong security engineers with high agency who can identify the risks that matter, build practical solutions, and take ownership from initial discovery through verified remediation
• 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level
• Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes
• Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation
• Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go
• Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity
• Experience threat modeling complex products and translating security risks into concrete engineering requirements
• Strong judgment when evaluating exploitability, business impact, and appropriate remediation
• Track record of partnering effectively with engineering and product teams while maintaining a high security bar
• Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders

Desirable

• Security is core to Phantom’s product and the trust millions of users place in us
• We’re building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work—from code review and threat modeling to vulnerability discovery and security automation
• This is a hands-on, high-impact role spanning architecture, source code, testing, and production systems across Phantom’s mobile, web, and backend products
• You’ll work directly with engineering and product teams, lead complex security initiatives, and build capabilities that scale across the company
• At the Staff level, you’ll set technical direction and raise the bar for how Phantom designs, builds, and ships secure products
• Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services
• Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations
• Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation
• Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production
• Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed
• Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows
• Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation
• Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards
• Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team
• This role offers the opportunity to:
• Protect products used by tens of millions of people
• Work on security problems spanning mobile, browser, backend, cloud, and blockchain systems
• Shape product architecture early rather than reviewing security only at the end
• Build durable security capabilities while the company and product surface continue to grow
• Work with engineers who care deeply about product quality, user experience, and security