Senior Application Security Engineer - Remote Blockchain

RootstockLabs; Portugal; Remote; EUR 80,000 - 120,000; Full time

Benefits offered by this job

Competitive compensation

100% Remote Work (CEST-Arg TZ window)

Work-Life Balance: vacation & sick pay

Continuous learning & sponsorships

Unique blockchain projects

Job summary

RootstockLabs is seeking an Application Security Engineer to secure our Bitcoin-backed DeFi infrastructure. You will review code, smart contracts, and protocol changes, build security automation, and coordinate bug bounty programs and audits. You will work with development teams on threat modeling and incident investigations.

The role emphasizes hands-on blockchain security, SAST/DAST, and CI/CD security gates, with a remote-friendly setup and strong collaboration across time zones.

Qualifications

• 3+ years in Application Security or Security Engineering.
• Solid grasp of OWASP Top 10 and secure code review in Java and at least one of TypeScript/JavaScript, Python, Go, or Rust.
• Hands-on blockchain security: smart contract auditing (Solidity/EVM) or protocol/node security.
• Experience building security automation, AI-assisted workflows, SAST/DAST, dependency and secret scanning, and CI/CD security gates.
• Fluent English.

Responsibilities

• Perform security reviews of source code, smart contracts, and protocol changes across RootstockLabs projects.
• Participate in design and architecture reviews; threat-model new products and features with development teams.
• Triage and validate bug bounty reports; assess severity and coordinate remediation with engineering.
• Collaborate on external security audits: scope engagements and work with third-party auditors through to the resolution of findings.
• Build and operate security automation, including AI-assisted code review, scanning, and findings-triage pipelines.
• Research attack techniques relevant to the ecosystem (EVM, bridges, p2p) and turn findings into concrete defenses: monitoring alerts, CI security checks, and hardening changes.
• Support incident investigations when application-layer issues arise.

Skills

Application Security

Secure code review

Java

TypeScript/JavaScript

Python

Go

Rust

Blockchain security

SAST/DAST

CI/CD security gates

Fluent English

Bug bounty triage

Network attack mitigation

Offensive security

Public security research

C/C++

Fuzzing

Tools

Auditing tools

Job description

RootstockLabs is seeking an Application Security Engineer to secure our Bitcoin-backed DeFi infrastructure. You will review code, smart contracts, and protocol changes, build security automation, and coordinate bug bounty programs and audits. You will work with development teams on threat modeling and incident investigations.

The role emphasizes hands-on blockchain security, SAST/DAST, and CI/CD security gates, with a remote-friendly setup and strong collaboration across time zones.