Security Engineer

Role overview Own application and product security for blockchain infrastructure and related developer and user products. The work spans vulnerability reporting and audits, secure code and software supply chains, incident response, and tools that help protect users from scams and abuse.

Responsibilities - Run bug bounty operations, from triage and severity decisions to remediation checks and payouts; turn recurring findings into automated safeguards. - Plan external security audits, support technical reviews, and track issues through fixes and validation. - Review designs and security-sensitive code in Rust, TypeScript, and Move; investigate incidents and check for related vulnerabilities across systems. - Strengthen dependency, CI/CD, and build-provenance defenses, including detecting compromised packages, maintainers, or pipelines. - Develop ways to identify phishing sites, malicious decentralized applications, and drainer contracts, and coordinate mitigations with wallet teams. - Build security analysis and review tooling, including static and dynamic checks and AI-assisted workflows integrated into development.

Requirements - At least three years in security, application security, or product security, with evidence of finding real vulnerabilities through reports, audits, CVEs, or research. - Strong understanding of common application vulnerabilities, supply-chain risks, and practical cryptographic failures. - Proficiency in at least one of Rust, TypeScript, Python, or Move, with experience reviewing or writing security-sensitive code. - Hands-on knowledge of package ecosystems, CI/CD security, and build provenance. - Experience participating in a bug bounty program or security audit, plus clear written and verbal communication skills. - A relevant degree or equivalent practical experience, and interest in web3.

Nice to have Smart contract or wallet security experience; familiarity with CodeQL, Semgrep, fuzzing, taint analysis, or symbolic execution; AI-assisted security tooling; anti-phishing or fraud work; knowledge of crypto attack patterns; or public security contributions such as rankings, CVEs, publications, or talks.

Benefits and work setup The team works remotely and hires across the world.