Staff Product Security Engineer (Security)

Phantom; United States; Remote; USD 180,000 - 250,000; Full time

Job summary

Phantom is hiring for a hands-on Staff Security Engineer to protect mobile, web, and backend products. You will partner with engineering teams to identify risks, lead architecture reviews, and embed practical security controls across the SDLC.

You'll perform AI-assisted code reviews, develop tooling for rapid security feedback, and drive vulnerability remediation. This fully remote role invites candidates from the US, UK, and Canada, with global security impact.

Qualifications

• Experience securing mobile, web, and backend products.
• Experience with vulnerability management and incident response.
• Ability to lead cross-functional security initiatives.

Responsibilities

• Partner with engineering to identify and address security risks across Phantom's mobile applications, web products, APIs, and backend services.
• Lead security reviews for new products and major architectural changes, with attention to authorization, data, and third-party integrations.
• Embed practical security controls into the software development lifecycle, from design through testing and production.
• Perform AI-assisted security code reviews and targeted testing of high-risk features; build repeatable approaches to find vulnerabilities before production.
• Develop tooling that provides engineers fast, actionable security feedback with minimal friction; use automation and AI where it increases coverage or speed.
• Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments; drive remediation with owners.
• Support investigation of security incidents and turn lessons into durable improvements to architecture and standards.
• Establish product security patterns and expectations across engineering; lead cross-functional initiatives at staff level.

Skills

Security engineering

Threat modeling

Code review

Security testing

AI-driven security

Security tooling

Tools

CI/CD tooling

Job description

Phantom is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets that never close, including perpetuals, prediction markets, tokenized assets, stablecoins and memes. Phantom users are able to discover the markets that matter and the cultural moments that shape them, building conviction through real-time data and the verified performance of top traders. With self-custody and access to open networks at its core, Phantom lets them control their financial moves in the same app they use to safely store or spend money worldwide.

Phantom has reached #1 in Google Play's finance category and consistently ranks in the top 50 apps across all categories. Phantom partners with many of the most trusted and influential names in finance like Hyperliquid, Stripe, Kalshi and Visa, to make the most popular and innovative financial products accessible to everyone.

We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm.

Security is core to Phantom's product and the trust millions of users place in us. We're building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work—from code review and threat modeling to vulnerability discovery and security automation. We're looking for strong security engineers with high agency who can identify the risks that matter, build practical solutions, and take ownership from initial discovery through verified remediation.

This is a hands-on, high-impact role spanning architecture, source code, testing, and production systems across Phantom's mobile, web, and backend products. You'll work directly with engineering and product teams, lead complex security initiatives, and build capabilities that scale across the company. At the Staff level, you'll set technical direction and raise the bar for how Phantom designs, builds, and ships secure products.

This role is fully remote and open to candidates based in the US, UK and Canada.

Responsibilities

• Product Security Ownership: Partner with engineering teams to identify and address security risks across Phantom's mobile applications, web products, APIs, and backend services.
• Architecture and Threat Modeling: Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations.
• Secure Product Development: Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation.
• Code Review and Security Testing: Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production.
• Security Tooling: Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed.
• Software Supply Chain Security: Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows.
• Vulnerability Management: Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation.
• Incident Response: Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards.
• Technical Leadership: Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team