Remote Security Engineer - Bug Bounty & Audits

Mysten Labs, Inc.; Toronto; Remote; CAD 198,000 - 269,000; Full time

Job summary

Mysten Labs is seeking a hands-on Security Engineer with strong application security fundamentals to own bug bounty programs, audits, and the secure code and software supply chain across the Sui ecosystem. You will build tooling to protect Mysten's products and users, conduct reviews of Rust, TypeScript, Move code, and drive remediation through external engagements, automation, and incident response.

We are remote-first and hire across the world, seeking candidates who thrive in a fast,

Qualifications

• Bachelor's degree in CS or equivalent practical experience.
• 3+ years in security engineering with documented vulnerabilities (bug bounty reports, audit findings, CVEs).
• Strong Web2 security fundamentals: XSS, CSRF, SSRF, auth flaws, injections, deserialization, supply chain failures, crypto issues.
• Proficiency in Rust, TypeScript, Python or Move; security review experience.
• Knowledge of software supply chain attack surface: npm, crates.io, PyPI; CI/CD security.
• Solid understanding of applied cryptography and common misuse patterns.
• Experience on bug bounty programs or audits; strong written/verbal communication; ability to influence teams.
• Interest in the web3 space is required.

Responsibilities

• Run Mysten's bug bounty programs: triage, severity, payouts, automation of recurring classes.
• Own audit engagements: scope, schedule, remediation tracking, technical counterpart during engagements.
• Conduct code/design reviews across Rust, TypeScript, Move; drive issues to closure and incident response.
• Own software supply chain security: dependencies, CI/CD, provenance, malware defenses, build signing.
• Build anti-scam/anti-abuse tooling for the Sui ecosystem and collaborate with wallet teams.
• Develop and integrate LLM-driven triage and static/dynamic analysis into CI and code review.

Skills

Rust

TypeScript

Python

Move

Security engineering

Education

Bachelor's degree in CS or equivalent

Equivalent practical experience

Tools

GitHub Actions

CodeQL

Semgrep

Endor Labs

Job description

Mysten Labs is seeking a hands-on Security Engineer with strong application security fundamentals to own bug bounty programs, audits, and the secure code and software supply chain across the Sui ecosystem. You will build tooling to protect Mysten's products and users, conduct reviews of Rust, TypeScript, Move code, and drive remediation through external engagements, automation, and incident response.

We are remote-first and hire across the world, seeking candidates who thrive in a fast,