Senior Security Engineer – Product Security

🔥 1 minute ago

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Ondo Finance

WebsiteLinkedInAll Job Openings

51 - 200 employees

₿ Crypto

💳 Fintech

💸 Finance

💰 Initial Coin Offering - Ondo Finance on 2024-01

Crypto • Fintech • Finance

Ondo is a company building institutional-grade onchain financial infrastructure and products that bridge traditional finance (TradFi) and decentralized finance (DeFi). Its offerings include tokenized public securities (Ondo Stocks) that make public securities freely transferable and usable in DeFi, USDY (a permissionless yield-bearing stablecoin), and OUSG (an institutional product offering exposure to short-term US Treasuries with 24/7 instant minting and redemptions). Ondo emphasizes compliance, institutional-grade security, third-party audits, and partnerships with asset managers and regulated service providers. The company’s Nexus technology enables instant minting and redemption for tokenized US Treasuries and stablecoins and supports omnichain issuance and distribution. Ondo works with partners like Broadridge, J. P. Morgan, Mastercard, Ripple, and asset managers to bring voting and cross-border redemption capabilities to tokenized assets.

📋 Description

• Drive threat modeling for new features, integrations, and architectural changes across the product surface • Own secure code review for high-risk changes involving authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, and permission and consent surfaces • Expand and tune the AppSec tooling stack, including reducing false positives and supporting AI-native integrations • Design and evolve the secure SDLC, including security workflow integration, review triggers, security sign-offs, and control validation • Run the responsible disclosure and bug bounty program, including scope-setting, report triage, payout decisions, and remediation tracking • Support and own intake and closure of findings from external audits and penetration tests; coordinate with audit vendors and engineering owners • Partner with engineering leads on secure-by-default libraries, templates, defaults, and paved-road implementations • Threat model blockchain-integrated components such as wallet flows, RPC integrations, signing infrastructure, and on-chain admin actions triggered by off-chain systems • Contribute to hiring, mentoring, and raising the technical bar on the Security team

🎯 Requirements

• 5+ years in Product Security or Application Security, including senior IC experience at a fast-moving product company • Deep secure code review skills in at least one of TypeScript/JavaScript, Python, or Go • Ability to move across technology stacks at the level required to threat model • Strong threat modeling skills, including applying industry-relevant TTPs and IoCs to products • Practical experience owning or majorly contributing to an AppSec tooling program; shipping rules, tuning noise, and measuring impact • Experience running or building a bug bounty/responsible disclosure program end-to-end • Strong working knowledge of modern web and API security, including session and authentication flows, OAuth, OIDC, browser security model, and web/API vulnerability classes • Ability to read Terraform, cloud IAM policies, and CI/CD configuration to assess product vulnerabilities and infrastructure risk • Strong engineering partnership skills and ability to make and document risk-control decisions • Willingness to grow into blockchain-adjacent product security, including wallet, signing, and on-chain integration attack surfaces • By Day 1, strong intuitions about how blockchains make product security experiences unique, knowledge of common terminology, and ability to discuss relevant Web2-to-Web3 incident post-mortems • Prior work at a crypto, fintech, or high-value/irreversible-action company • Familiarity with wallet, signing, or key-management flows • Reading-level familiarity with Solidity or Rust • Bug bounty history, such as reports, CVEs, or published write-ups • Familiarity with browser-extension security, mobile app security, or account-abstraction wallet designs • Public output such as talks, blog posts, open-source tools, or CVEs