Senior Product Security Engineer - Threat Modeling

Ondo Finance; United States; Remote; USD 120,000 - 190,000; Full time

Job summary

Ondo Finance is seeking a Senior Security Engineer - Product Security to own how we ship secure products and partner with product engineering teams. You will drive threat modeling, own secure code reviews for high-risk changes, and maintain AppSec tooling while improving the SDLC.

This hands-on IC role also leads the bug bounty program and collaborates with AppSec, Infrasec, and SecOps to push security forward across the product surface.

Qualifications

• 5+ years in Product Security or Application Security.
• Deep secure code review skills in modern stacks (TypeScript/JavaScript, Python, or Go).
• Strong threat modeling skills with real-world application.
• Experience leading AppSec tooling programs and reducing false positives.
• Experience running bug bounty or responsible disclosure programs.

Responsibilities

• Drive threat modeling for new features and architectural changes across the product surface.
• Own secure code review for high-risk changes—authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, permission surfaces.
• Expand the AppSec tooling stack and reduce false positives; AI-native integrations are welcome.
• Design and evolve our secure SDLC and define risk-based security sign-offs.
• Run our bug bounty program; triage reports and coordinate remediation with engineering.
• Coordinate with audits and external pentest findings, organizing risks in the internal risk register.
• Promote secure-by-default patterns with engineering teams; partner with on-chain integration owners.

Skills

Threat modeling

Secure code review

AppSec tooling

DevSecOps collaboration

Blockchain exposure awareness

Education

Bachelor's in CS/Engineering

Tools

Terraform

CI/CD tooling

SAST/DAST tooling

Job description

Ondo Finance is seeking a Senior Security Engineer - Product Security to own how we ship secure products and partner with product engineering teams. You will drive threat modeling, own secure code reviews for high-risk changes, and maintain AppSec tooling while improving the SDLC.

This hands-on IC role also leads the bug bounty program and collaborates with AppSec, Infrasec, and SecOps to push security forward across the product surface.