Senior Security Engineer, Product & Infrastructure
S
SquadsFintech, cryptocurrency
Remote | North America or EuropeFull-TimeSenior
Salary$175K - $220K; $175K – $220K • Offers Equity
Apply NowOpens the employer's application page
Job Details
- Experience
- 8+ years in product security, application security, or security engineering
Requirements
- Bring 8+ years of experience in product security, application security, or security engineering, built on a software engineering foundation.
- Own threat modeling and architecture review for complex financial or distributed systems, with the standing to shape design decisions.
- Demonstrate a track record of finding critical, non-obvious vulnerabilities in large production codebases.
- Have experience reviewing TypeScript, Rust, Go, or Python code, including through LLM- and agent-based review workflows you built and ran.
- Have experience building and running a vulnerability management program or bug bounty end to end.
- Have experience with the CI/CD scanning that feeds a vulnerability management program.
- Bring deep expertise in IAM, secrets management, network controls, and container security on AWS or a comparable provider.
- Write clearly and exercise the judgment to work independently.
- Experience reviewing Solana programs (Rust/Anchor), working at an audit firm, cryptography and key management (HSMs, MPC, PKI), offensive testing across web and mobile, red teaming AI systems, or supporting SOC 2 from the product side is a plus.
Responsibilities
- Review product and engineering designs as a security partner, raising concerns while changes are still easy to make.
- Lead threat modeling and security design reviews for new products, features, and infrastructure changes.
- Perform secure code reviews across backend services, APIs, frontends, and Solana programs, focusing on authentication, authorization, and access control.
- Triage and prioritize findings from audits, penetration tests, code scanning, and bug bounty; track remediation and verify fixes.
- Set severity and SLA standards, and hold the team to them.
- Manage bug bounty intake, validate external reports against source code, coordinate with audit partners, and scope internal assessments.
- Tune and extend SAST, dependency, secrets, and container scanning in CI/CD.
- Review IAM, network controls, encryption, and secrets management across cloud environments, including API key ownership, permissions, and rotation.
- Assess production access for internal AI tools, MCP integrations, and agents, and scope their permissions.
- Define product security standards, review checklists, and developer guidance.
View Full Description & ApplyYou'll be redirected to the employer's site
