Senior Security Engineer, Product

Jito Labs; United States; On-site; USD 130,000 - 210,000; Full time

Job summary

Jito Labs seeks a senior security-focused software engineer to own product and protocol security across our Solana ecosystem. You will report to the Head of Security and collaborate with an Enterprise Security Engineer to secure the code we ship.

This role emphasizes threat modeling, secure design, and vulnerability testing, while advancing onchain monitoring, deployment hardening, and security tooling to protect high‑value assets and multisig controls.

Qualifications

• A software engineering background is essential and informs security work.
• Experienced in product security lifecycle: threat modeling, secure design reviews, and vulnerability testing.
• 5+ years of professional experience, with a meaningful portion in software engineering before security.
• Proficiency in at least one systems or backend language (Rust preferred; Go/C++/Python acceptable).
• Proven track record in product or application security, not just infra or compliance.
• Experience building security tooling or automation is a plus.

Responsibilities

• Threat modelling and secure design reviews early in the lifecycle.
• Hardening deployments across product lines and securing deploy processes.
• Ongoing internal audits and proactive issue detection.
• Onchain monitoring and building detections for proactive defense.
• Developing and maturing bug bounty operations and triage processes.
• Managing auditor findings and driving closure.
• AI-assisted security testing and continuous scanning initiatives.
• Securing high‑impact keys, wallets, multisigs, and security councils.

Skills

Software engineering background

Product security lifecycle

5+ years experience

Systems/backend language

Security tooling/automation

Threat modeling & secure design

Job description

About Jito

Jito builds the market layer of Solana: the execution, capital, and incentive infrastructure behind the network's onchain economy. That includes the validator client running the majority of Solana stake, BAM (a new framework for verifiable ordering, pre-execution privacy, and programmable blockspace), JitoSOL (the leading liquid staking token on Solana), and JTX (trading built directly on our own market infrastructure).

About Jito

Jito builds the Market Layer of Solana: the execution systems, capital markets, and incentive mechanisms that power real markets on-chain.

Our products process billions in daily transaction value. The Jito-Solana validator client runs on the vast majority of Solana's active stake. BAM is redefining how blocks get built. JitoSOL is the leading liquid staking token on the network. We are not building at the margins. We are building core infrastructure that Solana's economy runs on.

Now we're moving up the stack, bringing that same infrastructure advantage to products that traders and users interact with directly.

We're a team of around 50 people with product-market fit across multiple product lines and years of runway. We take hard problems seriously and move fast on them. Nothing is out of reach.

About the Role

We've gone from one main product line to four, and the security work on those products has outgrown the one person doing it. This role owns product and protocol security: the surface where our code meets real money.

You’ll report to the Head of Security and work alongside an Enterprise Security Engineer who owns internal infrastructure, identity and detection. The split is deliberate. They secure how we work; you secure what we ship.

This is an engineering role. Most of the backlog is code, not policy.

What You’ll Own

• Product and protocol security reviews: threat modeling, secure design review, whitebox code review, and getting in early enough to change designs rather than document them
• Deployment hardening across our product lines, including the jito-solana deploy process
• Ongoing internal audits of our own products rather than waiting for an external engagement to surface issues
• Onchain monitoring: standing up tooling like Hypernative or Blockaid and building the detections that catch probing before an attack is underway
• Bug bounty operations as we bring more of the program in-house: triage, severity assessment, remediation tracking, and escalation
• Auditor findings driven through to closure: reviewed, prioritized, assigned, tracked
• AI-assisted security testing and continuous scanning, plus the security surface that comes with agents and AI tooling operating inside a codebase
• High-impact key and asset risks: key hygiene, hot wallet and engineering keys, multisigs, security councils

What We’re Looking For

• A software engineering background is essential. You've built production systems, and that foundation shapes how you approach security.
• You've since moved into product security and are fluent across the lifecycle: threat modeling, secure design review, whitebox code review, and vulnerability testing
• 5+ years of professional experience, with a meaningful portion in software engineering before moving into security
• Proficiency in at least one systems or backend language. Rust preferred; Go, C++, or Python also work. You will read production codebases and build tooling as routine parts of this job.
• Demonstrated experience in product or application security, not solely infrastructure or compliance work
• A track record of building security tooling or automation from