Staff Product Security Engineer (Security)

Phantom is a financial app that tens of millions of people use to access global markets through self-custody wallets. The platform ranks in Google Play's top finance apps and partners with names like Hyperliquid, Stripe, Kalshi and Visa. The company is fully remote with around 180 people, backed by a $150M Series C from a16z, Sequoia Capital and Paradigm.

The engineering team is building an AI-native security practice focused on expanding the speed and reach of vulnerability discovery, code review, threat modeling and security automation. You'll join as a Staff Product Security Engineer, working hands-on across Phantom's mobile, web and backend products while setting technical direction for how the company designs and ships secure products.

Your responsibilities will include

• Partnering with engineering teams to identify and address security risks across mobile applications, web products, APIs and backend services
• Leading security architecture reviews and threat modeling for new products and major changes, with focus on authorization boundaries, key management, transaction integrity and third-party integrations
• Embedding practical security controls throughout the software development lifecycle, from design through production operation
• Performing AI-assisted code reviews and targeted security testing on high-risk features, building repeatable approaches to catch vulnerabilities before release
• Developing tooling and automation that gives engineers fast, actionable security feedback without friction
• Hardening CI/CD and build systems against supply chain threats including dependency risk, secrets exposure, build provenance and artifact integrity
• Triaging findings from internal testing, researchers, bug bounty submissions and third-party assessments, driving issues to verified remediation
• Supporting investigation of product security incidents and translating lessons into durable improvements
• Establishing product security patterns across engineering teams and leading cross-functional security initiatives

You'll bring at least 5 years in product security, application security or senior software engineering roles. You have strong hands-on knowledge of web, mobile, API and distributed-system security including authentication, authorization, cryptography and common vulnerabilities. You've built or applied AI-assisted security tooling and can review production code in TypeScript, JavaScript, Rust, Python or Go. Experience with software supply chain security, CI/CD hardening, threat modeling complex products and securing browser extensions or native mobile applications is essential. You communicate clearly with both engineers and non-security stakeholders about technical risk.

Nice to have

• Background securing consumer financial products, wallets, payments or systems where client integrity matters
• Familiarity with blockchain, smart contracts, transaction simulation, signing workflows or self-custodial wallet architecture
• Experience building application-security tooling, static or dynamic analysis, or policy-as-code controls

This is a fully remote role open to candidates in the US, UK and Canada.