资深产品安全工程师
Staff Product Security Engineer
Phantom 的使命是将世界与开放市场的自由连接起来。数以百万计的人在全球使用 Phantom 来访问永不关闭的全球市场，包括永续合约、预测市场、代币化资产、稳定币和网络迷因。Phantom 用户能够发现重要的市场和塑造它们的文化时刻，通过实时数据和顶级交易者的验证表现建立信心。以自我托管和对开放网络的访问为核心，Phantom 让他们在一个应用中掌控自己的财务决策，该应用用于安全地存储或花费全球货币。
Phantom 在 Google Play 的金融类别中排名第一，并且在所有类别中始终位列前 50 名应用。Phantom 与 Hyperliquid、Stripe、Kalshi 和 Visa 等金融领域最值得信赖和有影响力的名字合作，使最受欢迎和创新的金融产品对每个人都可以使用。
我们大约有 180 人，全部远程办公，由 a16z、Sequoia Capital 和 Paradigm 提供的 1.5 亿美元 C 轮融资支持。
## **职责**
安全是产品核心，也是数百万人信任 Phantom 安全存储他们的加密资产的原因。作为安全工程师，您将负责识别、利用和缓解软件应用程序中的安全漏洞风险，以及进行安全评估和调查。您将与开发团队紧密合作，确保安全贯穿整个软件开发生命周期。加入我们，共同实现让数字经济对每个人来说都安全且易于使用的使命。
- 对新项目、基础设施和代码进行定期安全评估。
- 通过手动测试、自动化工具、威胁建模和威胁情报，在代码、系统和网络中识别并缓解安全漏洞。
- 跟踪最新的进攻性安全技术、应用安全威胁以及区块链领域的最佳实践，并建议改进安全态势。
- 编写详细的发现报告，并向管理层和技术团队汇报，帮助防止现实世界的攻击。
- 与开发团队合作，实施安全编码实践，并确保加密功能的完整性。
- 与其他团队（如开发和平台团队）协作，确保安全贯穿整个组织。
查看英文原文
[Phantom](https://phantom.com) is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets that never close, including perpetuals, prediction markets, tokenized assets, stablecoins and memes. Phantom users are able to discover the markets that matter and the cultural moments that shape them, building conviction through real-time data and the verified performance of top traders. With self-custody and access to open networks at its core, Phantom lets them control their financial moves in the same app they use to safely store or spend money worldwide.
Phantom has reached #1 in Google Play's finance category and consistently ranks in the top 50 apps across all categories. Check out our [Forbes Fintech 50](https://www.forbes.com/sites/ninabambysheva/2026/02/23/inside-phantoms-battle-plan-to-win-the-crypto-fueled-superapp-war/) and CNBC and Statista's [World's Top Fintech Companies 2026](https://www.cnbc.com/worlds-top-fintech-companies-2026/)!
We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm.
### Role Description
Security is core to Phantom’s product and the trust millions of users place in us. We’re building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work—from code review and threat modeling to vulnerability discovery and security automation. We’re looking for strong security engineers with high agency who can identify the risks that matter, build practical solutions, and take ownership from initial discovery through verified remediation.
This is a hands-on, high-impact role spanning architecture, source code, testing, and production systems across Phantom’s mobile, web, and backend products. You’ll work directly with engineering and product teams, lead complex security initiatives, and build capabilities that scale across the company. At the Staff level, you’ll set technical direction and raise the bar for how Phantom designs, builds, and ships secure products.
This role is fully remote and open to candidates based in the US, UK and Canada.
### Responsibilities
- **Product Security Ownership:** Partner with engineering teams to identify and address security risks across Phantom’s mobile applications, web products, APIs, and backend services.
- **Architecture and Threat Modeling:** Lead security reviews for new products and major architectural changes, with particular attention to authorization boundaries, sensitive data, transaction integrity, key material, and third-party integrations.
- **Secure Product Development:** Embed practical security controls into the software development lifecycle, from design and implementation through testing, release, and production operation.
- **Code Review and Security Testing:** Perform AI assisted security code reviews and targeted testing of high-risk features. Build repeatable approaches that help find vulnerabilities before they reach production.
- **Security Tooling:** Develop and improve tooling that gives engineers fast, actionable security feedback without creating unnecessary friction. Use automation and AI-assisted workflows where they materially improve coverage or speed.
- **Software Supply Chain Security:** Harden CI/CD, build, and release systems against supply chain threats, including dependency risk, secrets exposure, build provenance, artifact integrity, and compromised developer or automation workflows.
- **Vulnerability Management:** Triage findings from internal testing, researchers, bug bounty submissions, and third-party assessments. Work with owners to determine real-world impact and drive issues through verified remediation.
- **Incident Response:** Support the investigation of product security incidents and suspicious activity. Turn lessons from incidents into durable improvements to product architecture, detection, and engineering standards.
- **Technical Leadership:** Establish product security patterns and expectations across engineering. At the Staff level, lead ambiguous, cross-functional initiatives and influence architecture beyond any single product team.
### Qualifications
- 5+ years of experience in product security, application security, security engineering, or software engineering, including experience operating at a senior or staff level.
- Strong understanding of web, mobile, API, and distributed-system security, including authentication, authorization, session management, cryptography, and common vulnerability classes.
- Hands-on experience building or applying AI-assisted security tooling to test applications and APIs, combining automated analysis with source-code review and manual validation.
- Demonstrated ability to review production code in one or more languages such as TypeScript, JavaScript, Rust, Python and Go.
- Experience securing software supply chains and CI/CD systems, including dependencies, build infrastructure, secrets, artifacts, signing, and release integrity.
- Experience threat modeling complex products and translating security risks into concrete engineering requirements.
- Strong judgment when evaluating exploitability, business impact, and appropriate remediation.
- Track record of partnering effectively with engineering and product teams while maintaining a high security bar.
- Clear written and verbal communication, including the ability to explain technical risk to both engineers and non-security stakeholders.
### Nice To Haves
- Experience securing consumer financial products, wallets, payments, or other systems where client integrity and transaction safety are critical.
- Familiarity with blockchain systems, smart-contract interactions, transaction simulation, signing workflows, or self-custodial wallet architecture.
- Experience securing browser extensions or native mobile applications.
- Experience building and integrating application-security tooling, static or dynamic analysis, security test infrastructure, or policy-as-code controls.
- Familiarity with AWS, Kubernetes, CI/CD systems, and cloud-native service architectures.
- Experience working with bug bounty programs or coordinating external security assessments.
The target base salary for this role will range between $200,000 to $250,000 with the addition of equity and benefits. This is determined by a few factors including your skillset, prior relevant experience, quality of interviews and market factors (such as location) at the point in time of offer.
**Why Work With Us**
Phantom's journey to becoming a global trading app began with making crypto easier to use.Today, we’re building on that foundation to help people discover the markets that matter, make informed financial moves, and safely store or spend their money worldwide. Joining Phantom means helping shape that next chapter: building products that bring the freedom of open markets to more people.
- **Build for global impact:** Create products used by tens of millions of people, making innovative financial markets more accessible to users around the world.
- **Make complexity feel simple:** Solve meaningful challenges across design, engineering, and user experience to make discovering markets and managing money seamless.
- **Put users in control:** Help build a future where people have greater freedom over their assets and financial decisions, with security and self-custody at the foundation.
**Benefits**( _only available to full-time employees)_
- Competitive salary and equity
- Comprehensive insurance (medical/dental/vision): base plan 100% covered
- Flexible hours and a long-standing, supportive remote environment
- Unlimited vacation: Take time when you need it (and we really mean it!)
- 401(k) retirement plan
- Wellness stipend
- Weekly meal stipend
- Learning & Development stipend
- Remote / WFH set-up stipend
**We strongly encourage candidates of all backgrounds to apply.** We believe that our work is stronger with a variety of perspectives, and we’re eager to further diversify our company. If you have a background that you feel would make an impact at Phantom, please consider applying. We’re committed to building an inclusive, supportive place for you to do the best work of your career.
_By submitting your resume and application materials, you acknowledge and agree that Phantom Technologies, Inc. ("Phantom") collects and processes your personal information (including application materials, interview records, and related data) to evaluate your candidacy. Phantom may use AI-powered tools and third-party service providers for transcription, note-taking, scheduling, and other administrative tasks. Phantom does not sell your information and your materials will be handled securely and in accordance with applicable data protection laws._