Senior Security Engineer, Product & Infrastructure

Sqds; United States; Hybrid; USD 180,000 - 260,000; Full time

Job summary

Deciml, a Solana-native financial infrastructure company, seeks a senior, hands-on product and infrastructure security leader who will shape architecture and security tooling across the product suite and the shared infrastructure.

You will own threat modeling, secure code reviews, audits, and bug-bounty lifecycle, partnering with the Head of Security, CTO, and engineering leads to raise the security baseline while keeping velocity.

Qualifications

• 8+ years in product security, application security or security engineering, built on a software engineering foundation.
• Ownership of threat modeling and architecture review for complex financial or distributed systems.

Responsibilities

• Join product and engineering calls as the security reviewer, raising concerns while designs are still cheap to change.
• Lead threat modeling and security design reviews for new products, features and infrastructure changes.
• Perform hands-on secure code review across backend services, APIs, frontends and Solana programs, focused on authn, authz and access control.
• Own the full lifecycle for findings from audits, pentests, code scanning and bug bounty: triage, prioritisation, remediation tracking and fix verification.
• Set severity and SLA standards and hold the team to them; run bug bounty intake and validate external reports against source.
• Tune and extend SAST, dependency, secrets and container scanning in CI/CD so engineers trust the signal.
• Review IAM, network controls, encryption and secrets management across cloud environments, including API key ownership, permissions and rotation.
• Assess what internal AI tools, MCP integrations and agents can reach in production, and scope their access.
• Define product security standards, review checklists and developer guidance that scale with the team.

Skills

Threat modeling

Security design reviews

Secure code review

Vulnerability management

LLMs & agent workflows

CI/CD security tooling

IAM & secrets management

Cloud security (AWS)

Technical communication

Tools

SAST

Dependency scanning

Secrets management tooling

Container security scanning

Code review tooling

Job description

About the Company

A Solana-native financial infrastructure company building stablecoin-powered products for businesses and individuals, including secure asset management, business treasury accounts, personal finance apps and APIs for the stablecoin economy.

About the Role

This is a senior, hands-on product and infrastructure security role, working closely with the Head of Security, CTO and engineering leads across the company's product suite and the shared infrastructure beneath it.

• Sit in design reviews so security shapes architecture before it is built, rather than reviewing decisions after they are made.
• Read source code, write threat models, and build the tooling and standards that make the secure path the default as engineering grows.
• Own security for systems where a missed authorization check moves money.

Key Responsibilities

• Join product and engineering calls as the security reviewer, raising concerns while designs are still cheap to change.
• Lead threat modeling and security design reviews for new products, features and infrastructure changes.
• Perform hands-on secure code review across backend services, APIs, frontends and Solana programs, focused on authn, authz and access control.
• Own the full lifecycle for findings from audits, pentests, code scanning and bug bounty: triage, prioritisation, remediation tracking and fix verification.
• Set severity and SLA standards and hold the team to them; run bug bounty intake and validate external reports against source.
• Tune and extend SAST, dependency, secrets and container scanning in CI/CD so engineers trust the signal.
• Review IAM, network controls, encryption and secrets management across cloud environments, including API key ownership, permissions and rotation.
• Assess what internal AI tools, MCP integrations and agents can reach in production, and scope their access.
• Define product security standards, review checklists and developer guidance that scale with the team.

Requirements

• 8+ years in product security, application security or security engineering, built on a software engineering foundation.
• Ownership of threat modeling and architecture review for complex financial or distributed systems, with the standing to shape design decisions.
• Track record of finding critical, non-obvious vulnerabilities in large production codebases (TypeScript, Rust, Go or Python), including via LLM or agent-based review workflows you built and ran.
• Built and ran a vulnerability management programme or bug bounty end to end, including the CI/CD scanning (SAST, dependency, secrets, container) that feeds it.
• Deep expertise in IAM, secrets management, network controls and container security on AWS or a comparable provider.
• Strong written communication and the judgement to work independently.

What Great Looks Like

• You rank findings by what an attacker could actually do, and your write-ups tell engineers exactly what to change.
• You find business-logic, authorization and race-condition bugs by reading code, and know where scanners go blind.
• You use LLMs and agents to extend review coverage and know where the models miss.
• You pick your battles: engineers ship faster with you in the room, not slower.

Nice to Have

• Experience reviewing Solana programs (Rust/Anchor) or working at an audit firm.
• Cryptography and key management (HSMs, MPC, PKI).
• Offensive testing across web and mobile, or red teaming AI systems.
• Supporting SOC 2 from the product side.