Senior Security Engineer, Product & Infrastructure

About the Company A Solana-native financial infrastructure company building stablecoin-powered products for businesses and individuals, including secure asset management, business treasury accounts, personal finance apps and APIs for the stablecoin economy. About the Role This is a senior, hands-on product and infrastructure security role, working closely with the Head of Security, CTO and engineering leads across the company's product suite and the shared infrastructure beneath it. • Sit in design reviews so security shapes architecture before it is built, rather than reviewing decisions after they are made. • Read source code, write threat models, and build the tooling and standards that make the secure path the default as engineering grows. • Own security for systems where a missed authorization check moves money. Key Responsibilities • Join product and engineering calls as the security reviewer, raising concerns while designs are still cheap to change. • Lead threat modeling and security design reviews for new products, features and infrastructure changes. • Perform hands-on secure code review across backend services, APIs, frontends and Solana programs, focused on authn, authz and access control. • Own the full lifecycle for findings from audits, pentests, code scanning and bug bounty: triage, prioritisation, remediation tracking and fix verification. • Set severity and SLA standards and hold the team to them; run bug bounty intake and validate external reports against source. • Tune and extend SAST, dependency, secrets and container scanning in CI/CD so engineers trust the signal. • Review IAM, network controls, encryption and secrets management across cloud environments, including API key ownership, permissions and rotation. • Assess what internal AI tools, MCP integrations and agents can reach in production, and scope their access. • Define product security standards, review checklists and developer guidance that scale with the team. Requirements • 8+ years in product security, application security or security engineering, built on a software engineering foundation. • Ownership of threat modeling and architecture review for complex financial or distributed systems, with the standing to shape design decisions. • Track record of finding critical, non-obvious vulnerabilities in large production codebases (TypeScript, Rust, Go or Python), including via LLM or agent-based review workflows you built and ran. • Built and ran a vulnerability management programme or bug bounty end to end, including the CI/CD scanning (SAST, dependency, secrets, container) that feeds it. • Deep expertise in IAM, secrets management, network controls and container security on AWS or a comparable provider. • Strong written communication and the judgement to work independently. What Great Looks Like • You rank findings by what an attacker could actually do, and your write-ups tell engineers exactly what to change. • You find business-logic, authorization and race-condition bugs by reading code, and know where scanners go blind. • You use LLMs and agents to extend review coverage and know where the models miss. • You pick your battles: engineers ship faster with you in the room, not slower. Nice to Have • Experience reviewing Solana programs (Rust/Anchor) or working at an audit firm. • Cryptography and key management (HSMs, MPC, PKI). • Offensive testing across web and mobile, or red teaming AI systems. • Supporting SOC 2 from the product side.