Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 5 hours ago

Staff Product Security Engineer

DFNS12 open roles

Pay
$150,000 – $250,000 a year
Where
Paris
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowStaff Product Security EngineerDFNS · Paris

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on DFNS's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.8% of postings close within 7 days. Measured by our own scanner across the market. DFNS postings stay open a median of 20 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.8%7 days
  4. 22.3%14 days
  5. 37.8%30 days
  6. 59.0%60 days
This job: posted 5 hours ago

DFNS median: 20 days open

The posting

Staff Product Security Engineer

United States, remote first with NY office available · Full-time · Security · Reports to CISO

About DFNS

Finance is moving onchain. Stablecoins, tokenized deposits, securities and funds are changing how money and assets are issued, held and transferred. The destination is a financial system where any asset can be issued, moved and governed onchain with the controls regulated institutions require. That shift needs a new foundation. Just as core banking systems manage accounts and ledgers today, financial institutions need a platform to manage digital assets. DFNS is that platform. Today, we secure hundreds of billions of dollars in assets every month for more than 500 clients worldwide.

Why this role

Our platform secures a lot of value. Every code path, dependency and deployment is a potential route to that value. The record we are protecting is zero breaches. You will own the security of the product itself, from threat models and architecture reviews to the secure development lifecycle, pentests, bug bounty and incident response. In year one you will put automated security gates into CI/CD, threat model the signing path and the governance model end to end and become the engineer our clients’ security teams want in the room during due diligence.

What you’ll do

  • Own product security across the platform, from threat modeling and design reviews to code review and dynamic testing.
  • Build the secure development lifecycle into CI/CD, with SAST and DAST, dependency and supply chain controls (SBOM, signing, provenance) and secrets scanning running as automated gates.
  • Lead vulnerability management for the product, from triage and prioritization to fix verification and security releases, with Engineering.
  • Run the external pentest program and the bug bounty, and work directly with researchers.
  • Lead incident response for product security events, from detection and containment to forensics, post-mortems and the controls that follow.
  • Represent our security in client due diligence and audits, from security questionnaires and pentest reports to architecture sessions with bank security teams.
  • Raise the bar for every engineer through secure coding guidance, training and reusable security patterns and libraries.

What you bring

Must-haves

  • Hands-on application security on production systems that handle money or sensitive data, including threat modeling, code review and finding and fixing real vulnerabilities.
  • Ability to read and write TypeScript and Rust (or Go) well enough to review and fix security issues yourself.
  • Experience building security into CI/CD, including SAST and DAST, dependency and supply chain controls and secrets management.
  • Applied cryptography fluency. You know how keys, signatures, TLS and PKI get misused in practice and you can review an MPC or HSM integration without designing the protocol yourself.
  • Cloud security on AWS, including IAM, networking and KMS or Nitro Enclaves.
  • Experience running pentests or a bug bounty and leading incident response.
  • Communication that works with engineers and with external security teams such as bank CISOs and auditors.

Nice-to-haves

  • Smart contract security on EVM or Solana.
  • Experience with MPC or threshold signature systems, or with HSMs.
  • Published research, CVEs or conference talks.
  • Experience producing SOC 2 or ISO 27001 evidence for secure development controls.

How we work

We are a distributed company headquartered in Paris. Our teams work from Europe, the US and Asia, with offices in New York, Geneva, Dubai, Singapore, Hong Kong and São Paulo. We write decisions down so they survive time zones. We hold our own work to the standards our clients are held to. We hire people who can own an outcome end to end and we give them the room to do it.

What we offer

A competitive base salary set by role and location, a bonus or variable plan where the role carries one and stock options vesting over four years. Healthcare, flexible vacation, parental leave and a one-time home technology allowance, with travel expenses covered. A MacBook and the equipment you need to do your best work. Remote first, with an office if you want one.

Base salary range: $150,000-250,000

Hiring process

We aim to complete the process in 2 weeks and we tell you where you stand after every step.

  • Intro call with Co-CEO (30 minutes).
  • Personality and cognitive assessments, completed on your own time (45 minutes).
  • A technical take-home exercise
  • Focus Interviews (about 3 hours): CISO (30 minutes), technical exercise (45 minutes), general security (45 minutes), design security (45 minutes) and culture fit (30 minutes).
  • Reference calls and background checks.

Equal opportunity

DFNS is an equal opportunity employer and considers every applicant based on ability and potential, regardless of race, color, religion, sex, gender identity or expression, sexual orientation, national origin, disability, age or any other characteristic protected by law. If you need an accommodation at any point in the process, tell us and we will arrange it.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against DFNS's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on DFNS's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    DFNS's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.