[Hiring] Staff Product Security Engineer @DFNS

Role Description

Our platform secures a lot of value. Every code path, dependency and deployment is a potential route to that value. The record we are protecting is zero breaches. You will own the security of the product itself, from threat models and architecture reviews to the secure development lifecycle, pentests, bug bounty and incident response. In year one you will put automated security gates into CI/CD, threat model the signing path and the governance model end to end and become the engineer our clients’ security teams want in the room during due diligence.

• Own product security across the platform, from threat modeling and design reviews to code review and dynamic testing.
• Build the secure development lifecycle into CI/CD, with SAST and DAST, dependency and supply chain controls (SBOM, signing, provenance) and secrets scanning running as automated gates.
• Lead vulnerability management for the product, from triage and prioritization to fix verification and security releases, with Engineering.
• Run the external pentest program and the bug bounty, and work directly with researchers.
• Lead incident response for product security events, from detection and containment to forensics, post-mortems and the controls that follow.
• Represent our security in client due diligence and audits, from security questionnaires and pentest reports to architecture sessions with bank security teams.
• Raise the bar for every engineer through secure coding guidance, training and reusable security patterns and libraries.

Qualifications

• Hands-on application security on production systems that handle money or sensitive data, including threat modeling, code review and finding and fixing real vulnerabilities.
• Ability to read and write TypeScript and Rust (or Go) well enough to review and fix security issues yourself.
• Experience building security into CI/CD, including SAST and DAST, dependency and supply chain controls and secrets management.
• Applied cryptography fluency. You know how keys, signatures, TLS and PKI get misused in practice and you can review an MPC or HSM integration without designing the protocol yourself.
• Cloud security on AWS, including IAM, networking and KMS or Nitro Enclaves.
• Experience running pentests or a bug bounty and leading incident response.
• Communication that works with engineers and with external security teams such as bank CISOs and auditors.

Requirements

• Smart contract security on EVM or Solana.
• Experience with MPC or threshold signature systems, or with HSMs.
• Published research, CVEs or conference talks.
• Experience producing SOC 2 or ISO 27001 evidence for secure development controls.

Benefits

• A competitive base salary set by role and location, a bonus or variable plan where the role carries one and stock options vesting over four years.
• Healthcare, flexible vacation, parental leave and a one-time home technology allowance, with travel expenses covered.
• A MacBook and the equipment you need to do your best work.
• Remote first, with an office if you want one.

Company Description

DFNS is an equal opportunity employer and considers every applicant based on ability and potential, regardless of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, disability, age or any other characteristic protected by law. If you need an accommodation at any point in the process, tell us and we will arrange it.