Senior Security Engineer - Product Security

Ondo Finance is hiring a Senior Security Engineer - Product Security for a role based in Remote (US). This Web3job summary is prepared from the company’s official listing; confirm the complete scope and requirements on the source page before applying.

Key responsibilities

• Drive threat modeling for new features, integrations, and architectural changes across the product surface. Push threat models past templates into decisions that engineering teams actually implement.
• Own secure code review for high-risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, permission and consent surfaces.
• Expand the AppSec tooling stack and treat “reducing false positives” as a first-class deliverable. AI-native integrations are welcome.
• Shape the design of and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what a lightweight security sign-off looks like versus a full one, and how do we validate controls.
• Run our responsible disclosure and bug bounty program. Set scope, triage inbound reports, decide payouts, and drive findings to closure with engineering.
• Support and own appropriate scope for the intake and closure of findings from external audits and pentests — coordinate with audit vendors (Coinspect, Cantina, NCC Group, and others), organize findings into our internal risk register, and drive remediation with engineering owners.
• Partner with engineering leads to align o secure-by-default patterns - libraries, templates, sensible defaults, and paved-road implementations of anything security-relevant.
• Threat model blockchain-integrated components like wallet flows, RPC integrations, signing infrastructure, on-chain admin actions triggered from off-chain systems in partnership with engineers who own the on-chain code.
• Contribute to hiring, mentoring, and pushing the technical bar on the Security team.

What the team is looking for

• 5+ years in Product Security or Application Security, including senior IC time at a fast-moving product company.
• Deep secure code review skills in at least one modern stack (TypeScript / JavaScript, Python, or Go). Ability to move across stacks at the level required to threat model.
• Strong threat modeling skills, appropriate to experience - you can drive a real threat model with an engineering team, not just fill in a template. In practice, we look for core understanding of industry-relevant TTPs and IoCs and strong intuitions on how to apply those lessons learned to our products.
• Practical experience owning or majorly contributing to an AppSec tooling program. You have shipped rules, tuned noise, and measured impact.
• Comfortable running or building a bug bounty / responsible disclosure program end-to-end assuming properly resourced to do so.
• Strong working knowledge of modern web and API security - session and auth flows, OAuth and OIDC, browser security model, common web/API vulnerability classes, and their less-common variants.
• Comfortable reading Terraform, cloud IAM policies, and CI/CD configuration well enough to reason about how a product vulnerability crosses into an infra risk.
• Strong engineering partnership skills - you engage constructively, understand the “why” before proposing risk controls, you know when to accept risk, and you write things down.
• Willing to grow into blockchain-adjacent product security on the job, including the specific attack surface introduced by wallet, signing, and on-chain-integration code.

Source: View the original company listing and apply there.