Staff Platform Security Engineer

📋 Job Overview

Phantom is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets that never close, including perpetuals, prediction markets, tokenized assets, stablecoins and memes. Phantom users are able to discover the markets that matter and the cultural moments that shape them, building conviction through real-time data and the verified performance of top traders. With self-custody and access to open networks at its core, Phantom lets them control their financial moves in the same app they use to safely store or spend money worldwide.

Phantom has reached #1 in Google Play's finance category and consistently ranks in the top 50 apps across all categories. Phantom partners with many of the most trusted and influential names in finance like Hyperliquid, Stripe, Kalshi and Visa, to make the most popular and innovative financial products accessible to everyone.

We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm.

Platform security is foundational to protecting Phantom and the systems our users rely on. We’re hiring a Senior Platform Security Engineer to own and improve security across our AWS and Kubernetes environments. You’ll work directly with infrastructure and engineering teams to secure the control planes, identities, workloads, and deployment systems behind our most critical products.

We’re building an AI-native security team that aggressively uses AI to expand the speed, depth, and reach of our work. We’re looking for a strong security engineer with high agency who can identify the risks that matter, build practical controls, and own problems through verified remediation. This is a hands-on role for someone who is comfortable working in production systems, writing code and infrastructure, responding to incidents, and making security improvements without slowing down the teams building on the platform.

This role is fully remote; however, we’re only open to candidates based in the US and Canada.

🏢 About Phantom

Phantom is a global financial platform that connects millions of users to open markets. We are a fully remote team of around 180 people, backed by a $150M Series C investment from top-tier investors including a16z, Sequoia Capital, and Paradigm. Our mission is to provide accessible financial products and services to everyone, partnering with industry leaders like Hyperliquid, Stripe, Kalshi, and Visa.

🎯 The Role

You will be a key member of our AI-native security team, responsible for securing Phantom’s AWS and Kubernetes environments. This hands-on role involves working closely with infrastructure and engineering teams to implement security controls, respond to incidents, and improve platform security without slowing down development. You will own problems from initial investigation through implementation and verified remediation, leveraging AI-assisted workflows where appropriate.

✅ Key Responsibilities

• Own and improve security across Phantom’s multi-account AWS environment, including IAM, Identity Center, networking, compute, storage, secrets, logging, and organization-level guardrails.
• Secure production Kubernetes environments running on Amazon EKS, including cluster configuration, workload identity, RBAC, admission controls, network boundaries, secrets, container security, and tenant isolation.
• Design least-privilege access models for engineers, services, and automation. Build scoped, auditable, and time-bound access paths for sensitive production systems.
• Protect the infrastructure supporting products and services that handle sensitive data and high-value operations.
• Lead security design for new infrastructure, platform services, and major architectural changes.
• Build reusable security controls using tools such as Pulumi, Terraform, Kubernetes policy engines, and automated configuration validation.
• Harden build, deployment, and release systems, including GitHub Actions, workload federation, build runners, dependencies, artifacts, signing, provenance, and access to production environments.
• Build tools that identify and remediate cloud and Kubernetes risks at scale. Apply AI-assisted workflows where they materially improve analysis, coverage, or response speed.
• Partner closely with Infrastructure, SRE, Developer Experience, and product engineering teams. Establish practical platform-security standards and help teams adopt them.

📌 Required Qualifications

• 7+ years of experience in platform security, cloud security, infrastructure security, security engineering, or a closely related engineering role.
• Deep, hands-on experience securing production AWS environments. You understand IAM and resource policies, workload identity, network security, secrets management, logging, organization-level controls, and the ways these systems fail in practice.
• Deep experience securing Kubernetes in production, preferably Amazon EKS, including RBAC, workload identity, admission policy, network policy, pod security, secrets, and cluster hardening.
• Experience designing or securing mission-critical systems where compromise, excessive privilege, or loss of availability could have significant customer or business impact.
• Strong understanding of identity, authorization, least privilege, isolation, and blast-radius reduction across both human and machine access.
• Experience securing CI/CD and software supply chains, including GitHub Actions or similar systems, build runners, workload federation, artifacts, and production deployment paths.
• Experience writing and reviewing infrastructure as code using Pulumi, Terraform, CloudFormation, or similar tools.
• Ability to write production-quality code or automation in a language such as TypeScript, Python, Go, or Rust.
• High agency and ownership. You can take an ambiguous platform-security problem from initial investigation through implementation and verified remediation.
• Clear communication and a strong track record of partnering with infrastructure and engineering teams while maintaining a high security bar.

⭐ Desirable Experience

• Experience with AWS Nitro Enclaves or other trusted execution environments, including attestation, isolation boundaries, secure key handling, and operational lifecycle management.
• Experience securing financial, payments, wallet, custody, or other high-value transaction systems.
• Familiarity with key-management infrastructure, AWS KMS, CloudHSM, cryptographic signing systems, or secrets-management platforms.

🎁 Benefits

Phantom offers a competitive compensation package and a fully remote work environment. We are around 180 people, fully remote, backed by a $150M Series C investment from a16z, Sequoia Capital, and Paradigm.

🛂 Visa & Eligibility

This role is fully remote; however, we’re only open to candidates based in the US and Canada.