Staff Product Security Engineer

DFNS

3d•$150,000 - $250,000•Remote

About The Position

DFNS is hiring a Staff Product Security Engineer to own product security across its digital asset platform, which secures hundreds of billions of dollars in assets each month for more than 500 clients. Reporting to the CISO, the role covers security throughout the product lifecycle, including threat modeling, architecture and code reviews, secure development practices, testing, vulnerability management, incident response, and client security due diligence. In the first year, the engineer will introduce automated security gates into CI/CD, threat model the signing path and governance model end to end, and support client security teams during due diligence. The position is remote-first in the United States, with a New York office available, and is part of a distributed company headquartered in Paris.

Requirements

Hands-on application security experience on production systems handling money or sensitive data, including threat modeling, code review, and finding and fixing real vulnerabilities.
Ability to read and write TypeScript and Rust or Go well enough to review and fix security issues.
Experience building security into CI/CD, including SAST and DAST, dependency and supply chain controls, and secrets management.
Applied cryptography fluency, including practical understanding of how keys, signatures, TLS, and PKI are misused.
Ability to review an MPC or HSM integration without needing to design the protocol.
AWS cloud security experience, including IAM, networking, and KMS or Nitro Enclaves.
Experience running penetration tests or a bug bounty and leading incident response.
Communication skills for working with engineers and external security teams, including bank CISOs and auditors.

Nice To Haves

Smart contract security experience on EVM or Solana.
Experience with MPC or threshold signature systems, or with HSMs.
Published research, CVEs, or conference talks.
Experience producing SOC 2 or ISO 27001 evidence for secure development controls.

Responsibilities

Own product security across the platform, including threat modeling, design reviews, code review, and dynamic testing.
Build the secure development lifecycle into CI/CD, including automated SAST and DAST, dependency and supply chain controls such as SBOM, signing and provenance, and secrets scanning.
Lead product vulnerability management from triage and prioritization through fix verification and security releases in partnership with Engineering.
Run the external penetration testing program and bug bounty, and work directly with security researchers.
Lead product security incident response, including detection, containment, forensics, post-mortems, and follow-up controls.
Represent DFNS security in client due diligence and audits, including security questionnaires, penetration test reports, and architecture sessions with bank security teams.
Improve engineers’ security practices through secure coding guidance, training, and reusable security patterns and libraries.