Senior Application Security Engineer

RootstockLabs; Portugal; Remote; EUR 80,000 - 120,000; Full time

Benefits offered by this job

Competitive compensation

100% Remote Work (CEST-Arg TZ window)

Work-Life Balance: vacation & sick pay

Continuous learning & sponsorships

Unique blockchain projects

Job summary

RootstockLabs is seeking an Application Security Engineer to secure our Bitcoin-backed DeFi infrastructure. You will review code, smart contracts, and protocol changes, build security automation, and coordinate bug bounty programs and audits. You will work with development teams on threat modeling and incident investigations.

The role emphasizes hands-on blockchain security, SAST/DAST, and CI/CD security gates, with a remote-friendly setup and strong collaboration across time zones.

Qualifications

• 3+ years in Application Security or Security Engineering.
• Solid grasp of OWASP Top 10 and secure code review in Java and at least one of TypeScript/JavaScript, Python, Go, or Rust.
• Hands-on blockchain security: smart contract auditing (Solidity/EVM) or protocol/node security.
• Experience building security automation, AI-assisted workflows, SAST/DAST, dependency and secret scanning, and CI/CD security gates.
• Fluent English.

Responsibilities

• Perform security reviews of source code, smart contracts, and protocol changes across RootstockLabs projects.
• Participate in design and architecture reviews; threat-model new products and features with development teams.
• Triage and validate bug bounty reports; assess severity and coordinate remediation with engineering.
• Collaborate on external security audits: scope engagements and work with third-party auditors through to the resolution of findings.
• Build and operate security automation, including AI-assisted code review, scanning, and findings-triage pipelines.
• Research attack techniques relevant to the ecosystem (EVM, bridges, p2p) and turn findings into concrete defenses: monitoring alerts, CI security checks, and hardening changes.
• Support incident investigations when application-layer issues arise.

Skills

Application Security

Secure code review

Java

TypeScript/JavaScript

Python

Go

Rust

Blockchain security

SAST/DAST

CI/CD security gates

Fluent English

Bug bounty triage

Network attack mitigation

Offensive security

Public security research

C/C++

Fuzzing

Tools

Auditing tools

Job description

Listed on CyberJobs.cc, a job board for cybersecurity jobs from the team behind AITraining.jobs.

About The Role

As anApplication Security Engineerat RootstockLabs, you will help secure our Bitcoin-secured DeFi infrastructure by reviewing code, smart contracts, and protocol changes, and by building the security automation that keeps our development lifecycle safe. You will work closely with development teams on threat modeling and architecture reviews, manage our bug bounty program end to end, and coordinate external security audits with third‑party auditors. You will also research attack techniques relevant to our ecosystem (EVM, bridges, p2p) and translate them into concrete defenses, and support incident investigations when application‑layer issues arise.

Key Responsibilities

• Perform security reviews of source code, smart contracts, and protocol changes across RootstockLabs projects
• Participate in design and architecture reviews; threat-model new products and features with development teams
• Triage and validate bug bounty reports; assess severity and coordinate remediation with engineering
• Collaborate on external security audits: scope engagements and work with third-party auditors through to the resolution of findings
• Build and operate security automation, including AI-assisted code review, scanning, and findings-triage pipelines
• Research attack techniques relevant to the ecosystem (EVM, bridges, p2p) and turn findings into concrete defenses: monitoring alerts, CI security checks, and hardening changes
• Support incident investigations when application-layer issues arise

What You Bring

• 3+ years of experience in Application Security or Security Engineering
• Solid grasp of common vulnerability classes (OWASP Top 10) and secure code review in Java plus at least one of TypeScript/JavaScript, Python, Go, or Rust
• Hands‑on experience with blockchain security: smart contract auditing (Solidity/EVM) or protocol/node-level security
• Experience building and operating security automation, AI-assisted workflows (LLM-based triage, code review, or scanning), SAST/DAST, dependency and secret scanning, and CI/CD security gates
• Fluent English

NICE TO HAVE

• Experience in bug bounty triage or vulnerability disclosure programs
• Experience mitigating network-level attacks (p2p, eclipse, DoS) or analyzing consensus-level attack scenarios
• Offensive security background (pentesting, red team, CTFs, exploit development)
• Public security research: CVEs, bug bounty track record, audit reports, conference talks
• Knowledge of C/C++ (for node/client codebases)
• Experience with fuzzing (smart contracts or native code)

Rooties Benefits

• Competitive compensation package and unique benefits designed to support your growth and well-being.
• 100% Remote Work working within a Central European to Argentinian time-zone window (UTC-3 to UTC+2, with about an hour's flexibility either side), and with access to global coworking spaces.
• Work-Life Balance: Paid vacation and sick leave days
• Continuous Learning: Access to training programs, language courses, and learning sponsorship annually.
• Unique Projects: Work with cutting-edge blockchain technology in a global, diverse team.

About Rootstocklabs

RootstockLabs is a key contributor to Rootstock, Bitcoin's Financial Infrastructure for lending, yield, and onchain capital markets. We build and commercialize the institutional infrastructure that turns Bitcoin into productive capital.

• What we do: Develop and commercialize Bitcoin-backed lending, tokenized real-world assets, and onchain financial strategies
• Who we work with: Leading custodians, asset managers, and financial institutions
• Why it matters: Rootstock is secured by 80%+ of Bitcoin's hash power and has run with 100% uptime since 2018 (bringing Ethereum-style programmability to the world's hardest money).
• Proof it works: 200+ dApps live on Rootstock, from BTCFi protocols like Sushiswap and Oku to institutional names like Mercado Bitcoin, Animoca Brands, and Paystand