Senior Security Engineer - Product Security

Own product security at Ondo by partnering with engineering teams on threat modeling, secure code reviews, AppSec tooling, secure software development, responsible disclosure, bug bounty operations, audits, penetration tests, and blockchain-integrated product security.

Responsibilities

• Drive threat modeling for new features, integrations, and architectural changes
• Own secure code reviews for high-risk changes
• Expand and tune the AppSec tooling stack
• Design and evolve the secure software development lifecycle
• Run the responsible disclosure and bug bounty program
• Triage reports and drive findings to closure
• Coordinate external audits and penetration tests
• Organize findings in the internal risk register
• Establish secure-by-default libraries, templates, defaults, and implementations
• Threat model wallet flows, RPC integrations, signing infrastructure, and on-chain administrative actions
• Contribute to hiring and mentoring

Requirements

• 5+ years in Product Security or Application Security
• Senior individual contributor experience
• Secure code review
• TypeScript
• JavaScript
• Python
• Go
• Threat modeling
• Threat intelligence
• AppSec tooling
• Web security
• API security
• Session management
• Authentication
• OAuth
• OIDC
• Browser security
• Terraform
• Cloud IAM
• CI/CD
• Bug bounty
• Responsible disclosure
• Audit
• Penetration testing
• Risk register
• Blockchain security
• Wallet security
• Signing
• Key management
• Solidity
• Rust
• Browser-extension security
• Mobile app security