Security Engineer

Wormhole; Hinoba-an; Remote; PHP 7,385,000 - 11,077,000; Full time

Benefits offered by this job

Paid vacation

Equipment stipend

Pension plan

Life insurance

Premium healthcare

Bonus programs

Remote-friendly culture

Job summary

Wormhole is a remote-first security firm focused on long-term partnerships with blockchain and DeFi protocols. We seek a Security Engineer to assess and harden protocols through design feedback, manual analysis, and automated tooling.

You will collaborate with clients, conduct security research, and develop tooling to detect vulnerabilities early, while upholding confidentiality, trust, and professionalism in a decentralized, open-source–minded team.

Qualifications

• Strong desire to understand how things work
• Prior experience with code reviews, reverse engineering, fuzzing and/or binary exploitation
• Willingness and aptitude to learn different web3 technology stacks written in Rust, Golang or C
• Prior high ranking on bug bounty leaderboards, code audit contests, or CTF competitions. [Nice to have]

Responsibilities

• Design and implement security and defense-in-depth controls to prevent and limit vulnerabilities
• Perform cutting-edge security research in popular blockchains and smart contract platforms
• Develop security tooling and developer workflows to aid in the early detection of vulnerabilities
• Collaborate with core contributors to conduct internal security audits
• Shepherd external security audits with the help of leading third-party audit firms
• Operate bug bounty programs on Immunefi, including leading, monitoring, and triaging submissions
• Work in a diverse, decentralized team environment with web3 professionals
• Clearly communicate security risks, findings, and proposed solutions
• Adhere to the highest standards of integrity, trust, and professionalism

Skills

Code reviews

Reverse engineering

Fuzzing

Binary exploitation

Web3 knowledge

Rust

Golang

C

Bug bounty leaderboards

Tools

Immunefi platform

Job description

Location

Remote - AMER/EMEA/APAC

Employment Type

Full time

Location Type

Remote

Department

Security Engineering

Asymmetric Research:

Asymmetric Research is a specialized security firm focused on long-term, integrated partnerships with L1/L2 blockchains and DeFi protocols. We help teams build resilient systems, strengthen security posture, and proactively address emerging threats.

About the Role:

We are seeking a Security Engineer to review and secure leading blockchain protocols and web3 projects. You will partner with clients to harden their products through design feedback, deep manual analysis, and automated tooling (fuzzing, static analysis).

Culture:

AR is a fully remote organization and members of our team have been strongly committed to open-source values for decades, having worked at organizations with deep open-source roots and strong security programs including Google, Netflix, Mozilla, Stripe, and Jump Crypto. We pride ourselves on maintaining the highest levels of confidentiality, trust, and professionalism.

Responsibilities:

• Design and implement security and defense-in-depth controls to prevent and limit vulnerabilities.

• Perform cutting-edge security research in popular blockchains and smart contract platforms.

• Develop security tooling and developer workflows to aid in the early detection of vulnerabilities.

• Collaborate with core contributors to conduct internal security audits.

• Shepherd external security audits with the help of leading third-party audit firms.

• Operate bug bounty programs on Immunefi, including leading, monitoring, and triaging submissions.

• Work in a diverse, decentralized team environment with web3 professionals.

• Clearly communicate security risks, findings, and proposed solutions.

• Adhere to the highest standards of integrity, trust, and professionalism.

Requirements:

• Strong desire to understand how things work, with the ability to quickly absorb new information.

• Prior experience with code reviews, reverse engineering, fuzzing and/or binary exploitation.

• Willingness and aptitude to learn different web3 technology stacks written in Rust, Golang or C.

• Prior high ranking on bug bounty leaderboards, code audit contests, or CTF competitions. [Nice to have]

Benefits:

• 25 days of paid vacation

• Office and equipment stipend

• Pension / 401K programs

• Life insurance

• Premium healthcare

• Competitive base salary

• Lucrative bonus programs