Senior Product Security Engineer (Threat Modeling & AppSec)

Embedded Shishya; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

Ondo Finance is hiring a Senior Security Engineer - Product Security to own how we ship secure products. You will partner with product engineering teams to drive threat modeling, own secure code reviews for high‑risk changes, and scale AppSec tooling while improving the secure SDLC.

You will also lead our bug bounty program, coordinate external audits, and push for secure‑by‑default patterns across libraries, templates, and infrastructure.

Qualifications

• Drive threat modeling for features and architectural changes across the product surface.
• Own secure code review for high‑risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third‑party integrations, permission and consent surfaces.
• Expand the AppSec tooling stack and treat “reducing false positives” as a first‑class deliverable. AI‑native integrations are welcome.
• Design and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what a lightweight security sign‑off looks like versus a full one, and how do we validate controls.
• Run our responsible disclosure and bug bounty program. Set scope, triage inbound reports, decide payouts, and drive findings to closure with engineering.
• Support and own appropriate scope for the intake and closure of findings from external audits and pentests — coordinate with audit vendors, organize findings into our internal risk register, and drive remediation with engineering owners.
• Partner with engineering leads to align o secure‑by‑default patterns - libraries, templates, sensible defaults, and paved‑road implementations of anything security‑relevant.
• Threat model blockchain‑integrated components like wallet flows, RPC integrations, signing infrastructure, on‑chain admin actions triggered from off‑chain systems in partnership with engineers who own the on‑chain code.

Responsibilities

• Drive threat modeling for new features and architectural changes.
• Own secure code review for high‑risk changes (authentication, session management, cryptographic paths).
• Expand AppSec tooling and reduce false positives; enable AI‑native integrations.
• Design and evolve secure SDLC processes; define review triggers and sign‑off criteria.
• Lead the bug bounty program scope, triage reports, and drive remediation with engineering.
• Coordinate with external audits/pentest vendors and organize findings for remediation.

Skills

Threat modeling

Secure code review

AppSec tooling

Security SDLC

Bug bounty program

Audit coordination

Engineering collaboration

Tools

TypeScript/JavaScript

Python

Go

Terraform

CI/CD

Job description

Ondo Finance is hiring a Senior Security Engineer - Product Security to own how we ship secure products. You will partner with product engineering teams to drive threat modeling, own secure code reviews for high‑risk changes, and scale AppSec tooling while improving the secure SDLC.

You will also lead our bug bounty program, coordinate external audits, and push for secure‑by‑default patterns across libraries, templates, and infrastructure.