Senior Product Security Engineer: Threat Modeling & AppSec

SOLANA FOUNDATION; United States; On-site; USD 140,000 - 200,000; Full time

Job summary

Ondo Finance is hiring a Senior Security Engineer - Product Security to own security within our product development lifecycle. You will drive threat modeling, own secure code reviews for high‑risk changes, and expand AppSec tooling while guiding secure SDLC adoption.

You will also run our bug bounty program, coordinate with external audits, and partner with engineering to implement secure by default patterns across web and API surfaces, including wallet‑related workflows.

Qualifications

• 5+ years in Product Security or Application Security at a fast‑moving company.
• Deep secure code review skills in modern stacks (TypeScript/JavaScript, Python, or Go).
• Strong threat modeling skills with real engineering impact.
• Experience owning or contributing to an AppSec tooling program.
• Comfortable running a bug bounty / responsible disclosure program end‑to‑end.
• Strong knowledge of modern web and API security (OAuth/OIDC, session management).
• Familiarity reading Terraform and cloud IAM policies; CI/CD concepts.
• Solid engineering partner mindset and ability to drive risk decisions.

Responsibilities

• Drive threat modeling for new features and architectural changes and ensure engineering adoption.
• Own secure code review for high‑risk changes including authentication and signing flows.
• Expand AppSec tooling and reduce false positives, with AI‑native approaches welcomed.
• Design and evolve the secure SDLC and sign‑off processes.
• Run responsible disclosure and bug bounty programs, triage reports and drive remediation.
• Coordinate with audits and external pentests, organize findings, and drive fixes with engineers.
• Partner with engineering to promote secure‑by‑default patterns and safe defaults.
• Threat model blockchain‑integrated components and on‑chain integration risks.

Skills

Threat modeling

Secure code review

AppSec tooling

Bug bounty program

OAuth/OIDC

Web/API security

Terraform

CI/CD tooling

Tools

Terraform

CI/CD tooling

Job description

Ondo Finance is hiring a Senior Security Engineer - Product Security to own security within our product development lifecycle. You will drive threat modeling, own secure code reviews for high‑risk changes, and expand AppSec tooling while guiding secure SDLC adoption.

You will also run our bug bounty program, coordinate with external audits, and partner with engineering to implement secure by default patterns across web and API surfaces, including wallet‑related workflows.