- Review product and engineering designs as a security partner, raising concerns while changes are still easy to make.
- Lead threat modeling and security design reviews for new products, features, and infrastructure changes.
- Perform secure code reviews across backend services, APIs, frontends, and Solana programs, focusing on authentication, authorization, and access control.
- Triage and prioritize findings from audits, penetration tests, code scanning, and bug bounty; track remediation and verify fixes.
- Set severity and SLA standards, and hold the team to them.
- Manage bug bounty intake, validate external reports against source code, coordinate with audit partners, and scope internal assessments.
- Tune and extend SAST, dependency, secrets, and container scanning in CI/CD.
- Review IAM, network controls, encryption, and secrets management across cloud environments, including API key ownership, permissions, and rotation.
- Assess production access for internal AI tools, MCP integrations, and agents, and scope their permissions.
- Define product security standards, review checklists, and developer guidance.