Senior Security Engineer, Product & Infrastructure

Senior Security Engineer, Product & Infrastructure

Location: US or Europe

Salary: $175K - $220K

About the Company A Solana-native financial infrastructure company building stablecoin-powered products for businesses and individuals, including secure asset management, business treasury accounts, personal finance apps and APIs for the stablecoin economy. About the Role This is a senior, hands-on product and infrastructure security role, working closely with the Head of Security, CTO and engineering leads across the company's product suite and the shared infrastructure beneath it.

• Sit in design reviews so security shapes architecture before it is built, rather than reviewing decisions after they are made.
• Read source code, write threat models, and build the tooling and standards that make the secure path the default as engineering grows.
• Own security for systems where a missed authorization check moves money.

Key Responsibilities

• Join product and engineering calls as the security reviewer, raising concerns while designs are still cheap to change.
• Lead threat modeling and security design reviews for new products, features and infrastructure changes.
• Perform hands-on secure code review across backend services, APIs, frontends and Solana programs, focused on authn, authz and access control.
• Own the full lifecycle for findings from audits, pentests, code scanning and bug bounty: triage, prioritisation, remediation tracking and fix verification.
• Set severity and SLA standards and hold the team to them; run bug bounty intake and validate external reports against source.
• Tune and extend SAST, dependency, secrets and container scanning in CI/CD so engineers trust the signal.
• Review IAM, network controls, encryption and secrets management across cloud environments, including API key ownership, permissions and rotation.
• Assess what internal AI tools, MCP integrations and agents can reach in production, and scope their access.
• Define product security standards, review checklists and developer guidance that scale with the team.

Requirements

• 8+ years in product security, application security or security engineering, built on a software engineering foundation.
• Ownership of threat modeling and architecture review for complex financial or distributed systems, with the standing to shape design decisions.
• Track record of finding critical, non-obvious vulnerabilities in large production codebases (TypeScript, Rust, Go or Python), including via LLM or agent-based review workflows you built and ran.
• Built and ran a vulnerability management programme or bug bounty end to end, including the CI/CD scanning (SAST, dependency, secrets, container) that feeds it.
• Deep expertise in IAM, secrets management, network controls and container security on AWS or a comparable provider.
• Strong written communication and the judgement to work independently.

What Great Looks Like

• You rank findings by what an attacker could actually do, and your write-ups tell engineers exactly what to change.
• You find business-logic, authorization and race-condition bugs by reading code, and know where scanners go blind.
• You use LLMs and agents to extend review coverage and know where the models miss.
• You pick your battles: engineers ship faster with you in the room, not slower.

Nice to Have

• Experience reviewing Solana programs (Rust/Anchor) or working at an audit firm.
• Cryptography and key management (HSMs, MPC, PKI).
• Offensive testing across web and mobile, or red teaming AI systems.
• Supporting SOC 2 from the product side.