Senior Security Engineer - Product Security Remote (US)

Ondo; Northern (KY); Hybrid; USD 140,000 - 210,000; Full time

Job summary

Ondo Finance is seeking a Senior Security Engineer - Product Security. This hands-on IC role partners with product engineering to drive threat modeling, perform secure code reviews, and maintain AppSec tooling to keep products secure by default.

You'll own the bug bounty program, contribute to the security lifecycle, and work closely with SecOps and Infrasec. The role supports a remote US work model and requires strong risk-focused engineering practices.

Qualifications

• Experience driving threat modeling for product features and architecture.
• Hands-on secure code review for high-risk changes (auth, crypto, wallets, RPC).
• Experience expanding AppSec tooling and reducing false positives.
• Ability to drive secure SDLC within engineering teams.

Responsibilities

• Drive threat modeling for new features and architectural changes across the product surface.
• Own secure code review for high-risk changes including authentication, session management, cryptographic paths, wallet and signing flows.
• Expand AppSec tooling and reduce false positives; explore AI-native integrations.
• Design and evolve our secure SDLC and determine triggers for security reviews.

Skills

Threat modeling

Secure code reviews

AppSec tooling

SSDLC

AI-native security

Job description

Senior Security Engineer - Product Security

Remote (US)

About Ondo

Ondo Finance is building institutional-grade financial infrastructure for tokenized real-world assets. We operate at the intersection of traditional finance and on-chain systems, which means our product surface has to hold up against both the ordinary threats that hit any high-value fintech and the specific ones that follow value on-chain.

About the Role

We are hiring a Senior Security Engineer - Product Security to own how we ship secure products at Ondo. You will be a security partner for our product engineering teams, driving threat modeling, owning secure code reviews for new products or feature expansions, maintaining and tuning AppSec tooling, and improving the existing SSDLC. You can expect to take ownership of the bug bounty program, new feature to existing product reviews, and similar broad ownership of critical functions paired to a dedicated ProdSec lead. An AI-native approach is welcome, paired with AI-driven approaches should expect to be justified by describing how doing so enables risk outcomes.

This is a hands‑on IC role. You will read code, run threat models, review architecture proposals, own tooling, and push engineering teams to build products that are secure by default. You partner closely with adjacent security function like AppSec, Infrasec, and SecOps.

What You’ll Do

• Drive threat modeling for new features, integrations, and architectural changes across the product surface. Push threat models past templates into decisions that engineering teams actually implement.
• Own secure code review for high-risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third‑party integrations, permission and consent surfaces.
• Expand the AppSec tooling stack and treat “reducing false positives” as a first‑class deliverable. AI‑native integrations are welcome.
• Design and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what