Staff Platform Security Engineer (Security)

Phantom is a self-custody wallet and financial platform used by tens of millions globally to access markets like perpetuals, prediction markets, and tokenized assets. Founded on principles of open finance and user control, Phantom has grown to rank number one in Google Play's finance category. The company operates with roughly 180 fully remote team members, backed by $150M in Series C funding from a16z, Sequoia Capital, and Paradigm.

You'll join Phantom's Engineering team as Staff Platform Security Engineer, owning security across the AWS and Kubernetes infrastructure that powers the company's mission-critical financial systems. This is a hands-on role where you'll work directly with infrastructure, SRE, and product teams to identify risks, build controls, and drive remediation in production environments. You'll use code and automation—including AI-assisted tools—to scale your impact across cloud and container environments without creating friction for the teams building on the platform.

Your day-to-day will span

• Securing multi-account AWS environments at scale: IAM, Identity Center, networking, compute, storage, secrets, logging, and organization-level controls that protect user funds and sensitive data.

• Hardening production Kubernetes clusters on Amazon EKS, including RBAC, workload identity, admission controls, network policies, secrets management, and tenant isolation.

• Designing and implementing least-privilege access models for engineers, services, and automation with proper scoping, auditability, and time-bound credentials.

• Strengthening CI/CD and supply-chain security across GitHub Actions, build runners, workload federation, artifact management, and production deployment gates.

• Building reusable security controls using infrastructure-as-code tools like Pulumi, Terraform, and Kubernetes policy engines.

• Creating security automation that identifies and remediates cloud and Kubernetes risks at scale, leveraging AI where it meaningfully improves speed or coverage.

• Leading security architecture reviews for new infrastructure and major system changes.

• Partnering across teams to establish practical security standards and help engineers adopt them without slowing product development.

You'll bring 7+ years in platform security, cloud security, or infrastructure security roles. You have deep production experience with AWS—understanding how IAM, workload identity, networking, secrets, and organization controls actually fail in the real world. You've hardened production Kubernetes environments, ideally Amazon EKS, and know RBAC, workload identity, admission policies, and cluster hardening inside out. You're comfortable writing production-quality code in TypeScript, Python, Go, or Rust and reviewing infrastructure-as-code in Pulumi, Terraform, or CloudFormation. You've secured CI/CD systems and software supply chains. Most importantly, you have high agency: you can take an ambiguous security problem from initial investigation through implementation and verified fix, and you communicate clearly while maintaining a strong security bar across engineering teams.

Nice to have: experience with AWS Nitro Enclaves or trusted execution environments, background securing financial or custody systems, familiarity with key-management infrastructure and cryptographic signing systems, or experience operating multi-region Kubernetes and AWS at significant scale.

This is a fully remote role open to candidates in the US and Canada only.