CONTROL FIGHT · RWA · Ondo

Senior Security Engineer - Product Security

Product-security engineer for how Ondo ships: threat models, secure review of auth and signing paths, the bug bounty, and audit intake. Not the on-chain code owner.

You are deciding whether to build inside a tokenization firm whose acting chief executive may run the day and may not make a major change, while a lawsuit over control is open.

Blockchain Lab analysis, for a candidate deciding whether to apply. We are not the employer. Compensation on this posting: Not disclosed.

Listing age

61 days — confirm the req

Equity

Private. Illiquid.

Priced valuation

Not disclosed

Where

Remote (US)

Status: Open on the employer board — checked 2026-10-06
Board updated: 2026-08-06 · 61 days before this check
Location: Remote (US)
Remote eligibility: Remote (US). Not a worldwide-remote statement.
Employment: Not disclosed
Compensation: Not disclosed
Experience, as stored: 5+ years in product or application security, including senior individual-contributor time. From the posting.
Original post date: Not disclosed

Apply on the employer site The company Practice project

The company you would actually join

Blockchain Lab analysis

Public reporting and the employer’s own releases. Not a relationship with Blockchain Lab. Not a credit opinion.

Founded: By people from Goldman Sachs' digital-assets effort, as the stocks posting says. A founding year is not restated here.
Base: Remote (US) on all three seats. The blockchain posting also requires PT, MT, CT, or ET.
Status: Private. A control dispute is in the Delaware Court of Chancery. Not a credit opinion and not a prediction of the outcome.
People: Nathan Allman, founder, was reported to have died on 25 May 2026. Ian De Bode is the acting chief executive. Kathleen Allman, for the estate, is the plaintiff in the control case.

Ondo's commercial story is the one the industry has repeated for two years: institutional-grade tokens for assets that already exist, Treasuries first, stocks next. The three seats on this desk are that story split into a contract system, a consumer stocks product, and the security practice that has to survive both a fintech threat model and an on-chain one. Pay is not disclosed. Token rights are waved at you as a preference. A preference is not a grant.

The fact that should decide the application is not the TVL. On 23–25 September 2026 CoinDesk reported that Ondo was shopped to buyers after Nathan Allman's death on 25 May, citing three people familiar with the matter. Ondo called the report wholly untrue and said no one at the company sought buyers. Separately, the founder's estate is in the Delaware Court of Chancery against acting CEO Ian De Bode. Reporting says the court lets him run the day and stops major changes. If a 'major change' includes a sale, a new token plan, or your grant, you are interviewing into a company that cannot currently do the thing that would reprice your offer. Ask the recruiter to say that out loud.

Founders

Nathan Allman

Founder

CoinDesk reported that he died on 25 May 2026, and that the company was shopped to buyers afterward, citing unnamed people. Ondo called that sale report wholly untrue. He is not a person you will meet. His estate is a party to who controls your employer.

Ian De Bode

Acting CEO

Blockonomi, 25 September 2026: a court order lets him run daily operations and blocks major company changes while Kathleen Allman's case continues. The estate's complaint challenges how he took the chief executive's powers. He disputes that. This is an allegation and a denial, not a verdict.

What the company sells

Tokenized Treasuries

The stocks posting says Ondo was first to tokenize exposure to US Treasuries, then expanded. That is the employer's sentence.

Stocks

The product-manager seat is this product: brokerage, trading, and settlement made simple for a user. Do not assume the Treasury book is the job.

The stack around the token

The blockchain seat owns contract systems for their whole life, including the tools operators use. The security seat owns how products ship, including the bounty and audit intake.

Capital

Priced valuation

Not disclosed

Not in the sources this brief will stand behind.

Named backers

Employer list

Founders Fund, Pantera, Coinbase Ventures, Tiger Global, on the stocks posting.

Compensation

Not disclosed

The posting offers salary, token rights, and/or equity 'according to your preferences'. No number.

What the court froze

Major changes

Daily operations continue, as reported on 25 September 2026.

Before the listings
Venture backing, as the employer describes it
Not stated as a round size on the posting
The stocks posting says the firm is backed by Founders Fund, Coinbase Ventures, Pantera Capital, Tiger Global, and others, and that it is well capitalized. This brief does not turn that sentence into a valuation.
24 Jul 2026
Not a round. A lawsuit.
Control, not capital
Kathleen C. Allman v. Ondo, in the Delaware Court of Chancery, as reported. A hire's unvested equity, token rights, and reporting line sit inside that dispute whether or not anyone says so in the interview.

What should change your mind

Control litigation. Your manager's authority may be the subject of the case.
A denied sale report. The denial is the company's. The report is the newspaper's. You do not get to skip both.
Token rights with no number, and salary with no number.
Remote (US) is a country constraint. A line about a team 'across many countries' is not eligibility for this seat.

Ask them

Who is the employer of record, and who can approve a grant while the Chancery case is open?
What did the company mean by 'wholly untrue' — no outreach at all, or no outreach by current management?
Which product is live, which is a pilot, and which seat owns the stocks launch?
US remote: which entity, which states, which hours? The blockchain req names four US time zones.

Sources

If a figure is not in those sources, it is not in this brief on purpose.

What the employer actually wrote

Employer stated. Product-security engineer for how Ondo ships: threat models, secure review of auth and signing paths, the bug bounty, and audit intake. Not the on-chain code owner.

Drive threat modeling for new features, integrations, and architectural changes across the product surface. Push threat models past templates into decisions that engineering teams actually implement.
Own secure code review for high-risk changes — authentication, session management, cryptographic paths, wallet and signing flows, RPC and third-party integrations, permission and consent surfaces.
Expand the AppSec tooling stack and treat “reducing false positives” as a first-class deliverable. AI-native integrations are welcome.
Design and evolve our secure SDLC: where security fits in the dev workflow, what triggers a review, what a lightweight security sign-off looks like versus a full one, and how do we validate controls.
Run our responsible disclosure and bug bounty program. Set scope, triage inbound reports, decide payouts, and drive findings to closure with engineering.

Source: the employer’s public Greenhouse record, job 4357126009. Open the original. First seen by this desk 2026-10-06. Nothing above the fold is a substitute for that page.

A reading of the work

Blockchain Lab analysis. These lines are a reading of the advertisement. They are not extra hiring requirements.

Threat-model the privilege boundary before the bug list.
The posting names wallet, signing, and RPC paths. Start there.
A bounty program you do not resource is a mailbox, not a control.

Still not disclosed

Compensation, unless a figure appears in the header. None of these eighteen postings stated one.
Closing date, and the day the role was first published. The board timestamp is an update.
Visa sponsorship, on-call, and the employing subsidiary.

Not a recommendation to apply. Not an employer assessment. Figures from public reporting move, and a database is not a filing. How this desk labels evidence. Report a listing.

Ondo · Remote (US) · pay not disclosed

Apply