Staff Platform Security Engineer

Stack

Responsibilities

• ▹AWS Security: own and improve security across the multi-account AWS environment, including IAM, Identity Center, networking, compute, storage, secrets, logging and organization-level guardrails
• ▹Kubernetes Security: secure production Kubernetes environments on Amazon EKS, including cluster configuration, workload identity, RBAC, admission controls, network boundaries, secrets, container security and tenant isolation
• ▹Identity and Access: design least-privilege access models for engineers, services and automation; build scoped, auditable, time-bound access paths for sensitive production systems
• ▹Mission-Critical Systems: protect the infrastructure supporting products and services that handle sensitive data and high-value operations
• ▹Cloud Security Architecture: lead security design for new infrastructure, platform services and major architectural changes
• ▹Infrastructure and Policy as Code: build reusable security controls using tools such as Pulumi, Terraform, Kubernetes policy engines and automated configuration validation
• ▹CI/CD and Supply Chain Security: harden build, deployment and release systems, including GitHub Actions, workload federation, build runners, dependencies, artifacts, signing, provenance and access to production environments
• ▹Security Automation: build tools that identify and remediate cloud and Kubernetes risks at scale; apply AI-assisted workflows where they materially improve analysis, coverage or response speed
• ▹Cross-Functional Leadership: partner with Infrastructure, SRE, Developer Experience and product engineering teams; establish practical platform-security standards and help teams adopt them
• ▹Identify the risks that matter, build practical controls and own problems through verified remediation

Requirements

• ▹7+ years of experience in platform security, cloud security, infrastructure security, security engineering or a closely related engineering role
• ▹Deep, hands-on experience securing production AWS environments: IAM and resource policies, workload identity, network security, secrets management, logging, organization-level controls, and the ways these systems fail in practice
• ▹Deep experience securing Kubernetes in production, preferably Amazon EKS, including RBAC, workload identity, admission policy, network policy, pod security, secrets and cluster hardening
• ▹Experience designing or securing mission-critical systems where compromise, excessive privilege or loss of availability could have significant customer or business impact
• ▹Strong understanding of identity, authorization, least privilege, isolation and blast-radius reduction across both human and machine access
• ▹Experience securing CI/CD and software supply chains, including GitHub Actions or similar systems, build runners, workload federation, artifacts and production deployment paths
• ▹Experience writing and reviewing infrastructure as code using Pulumi, Terraform, CloudFormation or similar tools
• ▹Ability to write production-quality code or automation in a language such as TypeScript, Python, Go or Rust
• ▹High agency and ownership: taking an ambiguous platform-security problem from initial investigation through implementation and verified remediation
• ▹Clear communication and a strong track record of partnering with infrastructure and engineering teams while maintaining a high security bar
• ▹The role is fully remote, but only open to candidates based in the US and Canada

Nice to have

• ▹Experience with AWS Nitro Enclaves or other trusted execution environments, including attestation, isolation boundaries, secure key handling and operational lifecycle management
• ▹Experience securing financial, payments, wallet, custody or other high-value transaction systems
• ▹Familiarity with key-management infrastructure, AWS KMS, CloudHSM, cryptographic signing systems or secrets-management platforms
• ▹Experience operating or securing multi-region Kubernetes and AWS environments at significant scale
• ▹Familiarity with service meshes and cloud-native networking technologies such as Istio, PrivateLink, Transit Gateway or eBPF-based controls
• ▹Experience with GitHub OIDC, Argo CD, Helm, Crossplane or Kubernetes-based infrastructure delivery
• ▹Experience using cloud-security and observability platforms such as Wiz, Datadog, GuardDuty, Security Hub or CloudTrail
• ▹Experience building policy-as-code, automated remediation or security tooling used by a large engineering organization
• ▹Familiarity with blockchain infrastructure or self-custodial wallet architecture

Soft skills

What we offer

• ▹Competitive salary and equity
• ▹Eligibility for the performance bonus program
• ▹Comprehensive medical, dental and vision insurance with 100% coverage
• ▹Stipend for your ideal remote setup
• ▹Flexible hours and a supportive remote environment
• ▹Unlimited vacation
• ▹401(k) retirement plan
• ▹Monthly wellness benefit
• ▹Weekly meal benefit
• ▹Global off-sites

About the company

Phantom is a self-custody crypto wallet and finance app used by tens of millions of people worldwide to access global markets. The company has around 180 people, is fully remote, and is backed by a $150M Series C investment from a16z, Sequoia Capital and Paradigm.