Senior Security Engineer

SOLANA FOUNDATION; Northern (KY); Hybrid; USD 120,000 - 160,000; Full time

Benefits offered by this job

Token incentives

Job summary

Solana Foundation in the United States seeks a security-focused engineer to own a broad operational and technical scope, reporting to the Head of Security. You will triage access requests, conduct security reviews, and build testing frameworks with a focus on AI security and supply-chain risk.

You will work remotely with a small team, writing security tooling and contributing to production security reviews across the Solana ecosystem.

Qualifications

• A software engineering background and production systems experience.
• Experience in product security lifecycle: threat modeling, secure design reviews, whitebox code reviews, and vulnerability testing.
• 5+ years of professional experience, with a meaningful portion in software engineering before transitioning into security.
• Proficiency in Rust (preferred) or Go/C++/Python; ability to write code and build tooling.
• Demonstrated experience in product or application security beyond infrastructure or compliance.
• Track record of building security tooling or automation from scratch.
• Experience conducting or leading security reviews on production software systems.
• Strong understanding of identity and access management concepts and tooling.
• Genuine interest in AI security and adversarial testing tooling.
• Interest in software supply chain risk beyond checkbox scanning.
• Strong written communication and ability to work autonomously in a small team.
• Experience in web3, crypto, or DeFi.

Responsibilities

• Identity and access management provisioning, lifecycle operations, and monitoring for critical changes.
• Security reviews across the product portfolio, including threat modeling, code review, fuzzing, and functional testing.
• Day-to-day bug bounty operations: triage, remediation tracking, and escalation of high-severity findings.
• AI security research and tooling: adversarial testing frameworks for agent controls.
• Software supply chain monitoring: detecting malicious packages beyond standard CVE scanning.
• External penetration test coordination: scoping, logistics, and post-engagement remediation tracking.
• Compliance documentation and evidence gathering as requirements emerge.

Skills

Software engineering

Threat modeling

Code review

Vulnerability testing

Security tooling

Rust

Go

Python

IAM concepts

Web3/DeFi

Education

Bachelor's degree in Computer Science, Computer Engineering, or a related technical field

Tools

PAM tooling

IAM systems

Linux

TEEs

Job description

About Jito

Jito builds the market layer of Solana: the execution, capital, and incentive infrastructure behind the network's onchain economy. That includes the validator client running the majority of Solana stake, BAM (a new framework for verifiable ordering, pre-execution privacy, and programmable blockspace), JitoSOL (the leading liquid staking token on Solana), and JTX (trading built directly on our own market infrastructure). We are a lean, high-density team. Everyone here owns real surface area, works in the open, and ships at pace. The engineers on this team are the people market makers call when milliseconds matter.

About the Role

We're growing our security team and looking for an engineer who can own a broad operational and technical scope: someone equally at home triaging an access request, running a security review, or building a custom testing framework. You'll report directly to the Head of Security, working closely to strengthen and scale our security posture across the organization.

What You'll Do

• Identity and access management: provisioning, lifecycle operations, and monitoring for critical changes
• Security reviews across our product portfolio: threat modeling, code review, fuzzing, and functional testing
• Day-to-day bug bounty operations: triage, remediation tracking, and escalation of high-severity findings
• AI security research and tooling: adversarial testing frameworks for agent controls, with a focus on reusable patterns
• Software supply chain monitoring: malicious package detection beyond standard CVE scanning
• External penetration test coordination: scoping, logistics, and post-engagement remediation tracking
• Compliance documentation and evidence gathering as requirements emerge

What We're Looking For

• A software engineering background is essential: you've built production systems, and that foundation shapes how you approach security
• You've since moved into product security and are fluent in the full lifecycle: threat modeling, secure design review, whitebox code review, and vulnerability testing
• 5+ years of professional experience, with a meaningful portion in software engineering before transitioning into security
• Proficiency in at least one systems or backend language (Rust preferred; Go, C++, or Python also work). You will write code, build tooling, and read production codebases as a routine part of this role.
• Demonstrated experience in product or application security, not solely infrastructure- or compliance-focused roles
• Track record of building security tooling or automation from scratch
• Experience conducting or leading security reviews on production software systems
• Solid understanding of identity and access management concepts and tooling
• Genuine interest in AI security with the ability to build adversarial testing tooling
• A thoughtful approach to software supply chain risk beyond checkbox scanning
• Strong written communication: documentation is a real part of this job
• Comfortable with high ownership and working autonomously on a small team
• Experience in web3, crypto, or DeFi
• Bachelor's degree in Computer Science, Computer Engineering, or a related technical field

Nice to Have

• Hands-on experience with mobile device management (MDM) platforms and endpoint policy enforcement
• Familiarity with enterprise IAM systems and SSO: configuration, integration, and audit
• Experience with privileged access management (PAM) tooling and the operational patterns around it
• Strong Linux administration skills: comfortable at the command line, understanding of kernel-level security primitives, experience hardening Linux environments
• Experience with multisig schemes: signing policy design, quorum configuration, or key management in a production context
• Familiarity with hardware security modules (HSMs): integration, key lifecycle management, or operational use
• Exposure to trusted execution environments (TEEs): attestation, confidential compute, or secure enclave design

How we work

Remote-first, writing-heavy, and transparent by default: most decisions happen in public Slack channels, and everyone's voice carries. We value ownership, humility, curiosity, and getting it done over getting it perfect. Small egos, high standards.

What we offer

Competitive compensation including salary and token incentives, the tools you need to do your best work, and a seat at the center of Solana's market infrastructure alongside some of the strongest engineers in the ecosystem.

Jito is an equal opportunity employer. We evaluate candidates on the basis of their skills, experience, and potential contribution, without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, veteran status, or any other characteristic protected by law.