Application Security Engineer (Web3)

Institute of Free Technology; Barcelona; Presencial; EUR 45.000 - 70.000; Jornada completa

Descripción de la vacante

A leading technology institute seeks an Application Security Engineer specializing in Web3 security. The ideal candidate will have extensive experience in securing blockchain protocols and will focus on identifying and mitigating vulnerabilities through thorough code reviews and incident response strategies. This remote-friendly role emphasizes collaboration with development teams and preparation for external audits. Competitive compensation is offered in both fiat and crypto.

Formación

• Minimum 5 years in Web3 security engineering.
• Expertise in securing blockchain protocols and smart contracts.
• Strong knowledge of secure coding and risk mitigation.

Responsabilidades

• Conduct in-depth code reviews and identify vulnerabilities.
• Collaborate with development teams to remediate security issues.
• Prepare documentation for external security audits.

Conocimientos

Web3 Security Engineering

Secure Coding Practices

Incident Response

Communication Skills

Cryptographic Protocols

Herramientas

Static Analysis Tools

Dynamic Analysis Tools

Descripción del empleo

Join to apply for the Application Security Engineer (Web3) role at Institute of Free Technology

5 days ago Be among the first 25 applicants

Join to apply for the Application Security Engineer (Web3) role at Institute of Free Technology

Get AI-powered advice on this job and more exclusive features.

Direct message the job poster from Institute of Free Technology

• Only apply if you have several years of experience in Blockchain / Web3 / Crypto

Vac builds public good protocols for the decentralised web. We do applied research based on which we build protocols, libraries and publications.

Vac’s R&D Service Units are integral to supporting IFT (The Institute of Free Technology) projects by researching and developing base components and secure, unbiased protocols.

The Vac Security service unit provides comprehensive support to IFT projects by conducting security audits and helping develop robust security plans. In addition to assisting IFT projects, the security team also supports other IFT services by offering expert guidance on security best practices and risk management strategies. This collaborative approach ensures that all aspects of the IFT ecosystem benefit from enhanced security measures.

By identifying potential vulnerabilities, assessing risks, and implementing effective security solutions tailored to specific needs, the Vac Security service unit plays a crucial role in strengthening the overall security posture of IFT.

The role :

We are looking for an Application Security Engineer to join our security service unit. In this role, you’ll perform in-depth reviews of critical code (with a focus on low-level languages like Rust, Nim, and C++), identify both code-level and protocol-level vulnerabilities, and support incident response efforts.

You’ll collaborate closely with development teams to remediate security issues and ensure best practices are followed. You’ll also play a key role in preparing for external security audits—defining audit scope, organising technical documentation, and working directly with auditors to ensure valuable and actionable results.

This is a hands-on position for someone passionate about secure software development and proactive risk mitigation.

Key responsibilities :

• Perform in-depth manual and automated reviews of source code (with a focus on low-level languages such as Rust, Nim, and C++) to identify security vulnerabilities and logic flaws.
• Analyse and review critical code paths for potential weaknesses.
• Identify and assess both code-level vulnerabilities (e.g., buffer overflows, injection flaws) and protocol-level issues (e.g., insecure cryptographic implementations, protocol misconfigurations).
• Execute incident response activities, including detection, analysis, containment, and recovery, while documenting findings and lessons learned for continuous improvement.
• Collaborate with development and product teams to remediate identified vulnerabilities, provide security guidance, and ensure secure coding practices are followed.
• Define clear audit objectives and scope for external audits, focusing on the most critical components and protocols.
• Prepare and organise all relevant documentation (architecture diagrams, codebase, threat models, protocol specifications) to facilitate an efficient and valuable external audit process.
• Engage with external auditors early to clarify expectations and provide necessary context, ensuring the audit delivers actionable results.
• Address and remediate issues identified in previous audits, and document improvements to demonstrate ongoing security maturity.

You ideally will have :

• Minimum of 5 years of experience in Web3 security engineering, with proven experience securing blockchain protocols, smart contracts, or cryptographic systems.
• Expertise in secure coding practices, including identification of code / protocol-level vulnerabilities (e.g., buffer overflows, injection attacks) and code analysis / debugging.
• Experience with manual / automated code review techniques and penetration testing in Web3 ecosystems.
• Familiarity with cryptographic protocols, secure protocol design, and blockchain / distributed systems security.
• Incident response capabilities (detection, analysis, containment, recovery).
• Experience collaborating with development / product teams to remediate vulnerabilities, including SSDLC processes and external audit preparation.
• Strong documentation and communication skills for technical materials and stakeholder interactions (internal teams, auditors).
• Deep interest in blockchain technology and decentralisation.
• Experience with static and dynamic analysis tools (e.g. CodeQL, Valgrind).
• Knowledge of formal verification methods and tools.
• Background in penetration testing or red teaming.
• Ability to educate and train others on security best practices.
• Contributions to open-source security projects or published security research.

Hiring process :

• Interview with our Talent team.
• Interview with the Vac Security unit lead.
• Take home assignment + discussion with a team member from the Vac Security unit.
• Interview with a Vac team lead.

Compensation :

We are happy to pay in any mix of fiat / crypto.

Seniority level

• Seniority level Mid-Senior level

Employment type

• Employment type Full-time

Job function

• Job function Research
• Industries Software Development and Technology, Information and Internet

Referrals increase your chances of interviewing at Institute of Free Technology by 2x

Get notified about new Application Security Engineer jobs in Barcelona, Catalonia, Spain .

Application Security Engineer (100% remote-friendly within Spain)

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.

J-18808-Ljbffr