Senior Application Security Engineer

Role overview A senior application security role on a globally distributed team protecting a high-traffic self-custodial crypto wallet and decentralized application platform used by tens of millions of people. The position partners directly with engineering and product to embed security throughout the software development lifecycle and respond to vulnerabilities surfaced by external researchers.

Responsibilities - Triage, validate, and root-cause vulnerabilities submitted through a public bug bounty program, and drive resolution with product engineering teams. - Engage with external security researchers, communicating findings and guiding remediation within established SLAs. - Conduct design reviews, threat modeling, security testing, and code reviews on new features across web and mobile clients. - Build tooling, including AI-assisted systems, to accelerate vulnerability analysis and remediation, and patch identified issues directly in client codebases. - Identify gaps in the secure SDLC and lead initiatives to close them through automation, controls, training, and process improvements. - Validate that security fixes address the underlying issue and test for potential bypasses before release.

Requirements - 6+ years building and securing software, with hands-on application or product security experience. - Background securing modern backend systems, web applications, and APIs at scale. - Demonstrated experience performing threat modeling, security design reviews, and vulnerability assessments. - Proficiency securing JavaScript-based applications across web or mobile, ideally with Node.js, React, or React Native. - Strong coding skills with the ability to fix vulnerabilities alongside engineers. - Familiarity with blockchain technology, particularly Ethereum, decentralized applications, and crypto wallets, plus solid grounding in modern web and mobile attack vectors.

Nice to have - Prior software developer experience. - Deeper knowledge of Ethereum and other blockchains, including smart contract implementation and security.

Benefits and work setup Remote-first, globally distributed team with most time zones supported; some overlap with EU and US-Pacific hours required. US-based compensation listed between $130,000 and $218,000, with non-US packages set during the interview process. Note: candidates based in France, Italy, or Germany cannot be considered for this role.