Application Security Engineer: RootstockLabs

Wired Currencies; United States; Remote; USD 120,000 - 190,000; Full time

Benefits offered by this job

Remote work

Global coworking spaces

Paid vacation and sick leave

Training

Language courses

Learning sponsorship

Job summary

RootstockLabs Ltd. is hiring an Application Security Engineer for remote work across UTC-3 to UTC+2. The role involves reviewing source code, smart contracts, and protocol changes to identify security issues in Bitcoin-secured financial infrastructure.

It requires 3+ years in Application Security or Security Engineering and hands-on secure coding expertise. The position is fully remote, with a flexible time window, and supports security automation, external audits, and incident investigations.

Qualifications

• Requires at least 3 years in Application Security or Security Engineering.
• Proficient in secure code review and vulnerability knowledge.
• Experience with programming languages such as Java and at least one of TS/JS/Python/Go/Rust.

Responsibilities

• Review application source code, smart contracts, and protocol changes for security issues.
• Perform threat modeling and architecture reviews.
• Coordinate bug bounty triage and remediation with external audits.
• Support security automation, incident investigations, and CI/CD security controls.

Skills

Secure code review

OWASP Top 10

Java

TypeScript

JavaScript

Python

Go

Rust

Blockchain security

SAST/DAST

CI/CD security

Bug bounty triage

Vulnerability disclosure

Threat modeling

C/C++

Fuzzing

English fluency

Job description

RootstockLabs is hiring an Application Security Engineer for remote work across UTC-3 to UTC+2, with about an hour of flexibility on either side. The role reviews source code, smart contracts, and protocol changes across infrastructure for Bitcoin-secured finance. The position requires at least three years of Application Security or Security Engineering experience, secure code review skills, and working knowledge of common vulnerability classes including the OWASP Top 10.

The engineer will support RootstockLabs security work across code review, threat modeling, bug bounty triage, external audits, security automation, and application-layer incident investigations. The role is remote, and the published listing does not state a salary, employment type, or application deadline.

Role: Application Security Engineer

Employer: RootstockLabs Ltd.

Location: Remote, UTC-3 to UTC+2 with limited flexibility

Experience: 3+ years in Application Security or Security Engineering

Salary: Not provided by the employer.

Employment type: Not provided by the employer.

Benefits:

• Remote work
• global coworking spaces
• paid vacation and sick leave
• training
• language courses
• learning sponsorship

Application Security Work

• Source-code and smart-contract review
• Architecture review and threat modeling
• Bug bounty triage and remediation coordination
• External audit coordination
• Security automation and application-layer incident support

The role reviews application source code, smart contracts, and protocol changes before security issues reach production. Architecture reviews and threat modeling help the team examine trust boundaries, abuse paths, privileged operations, and assumptions around financial applications.

Security operations extend beyond code review. The engineer triages bug bounty reports, coordinates remediation, scopes external security audits, and supports application-layer incident investigations. Security automation includes AI-assisted review and scanning, static and dynamic analysis, dependency and secret scanning, and CI/CD security gates.

Required Security Skills

Secure code review and knowledge of OWASP Top 10 vulnerability classes are required. The language requirement includes Java plus at least one of TypeScript, JavaScript, Python, Go, or Rust. Blockchain security experience can involve Solidity and EVM smart contracts or protocol and node security.

The role also calls for experience with SAST and DAST, dependency and secret scanning, CI/CD security controls, and fluent English. Experience with bug bounty triage, vulnerability disclosure, offensive security, public security research, network-attack mitigation, consensus-attack analysis, C or C++, and fuzzing is listed as useful additional background.

RootstockLabs And Remote Work

RootstockLabs says it has built on Bitcoin since 2017, while Rootstock launched in 2018. The company works with developers, fintechs, and institutions on integrations, partner solutions, and liquidity for financial applications.

The employer describes its careers model as fully remote work with flexible working, city meet-ups, an annual company offsite, career development, and mentorship. The published role uses a working-time window from UTC-3 to UTC+2 rather than a single office location.

Application Questions

What experience does the role require?

The role requires at least three years in Application Security or Security Engineering, plus secure code review, vulnerability knowledge, and relevant programming experience.

Is the role remote?

Yes. The role is remote across UTC-3 to UTC+2, with about an hour of flexibility on either side.

What salary is offered?

Salary information was not provided by the employer.

What does the application require?

The application requires a resume or CV and LinkedIn profile, together with responses about security experience and related technical background.

The application process also asks candidates to describe languages reviewed for security, public security work, and AI use. Background and reference checks validate experience, qualifications, location, and professional history.

RootstockLabs places the position within work that connects application security to Bitcoin-secured financial infrastructure. The role's stated scope keeps the focus on secure software, smart contracts, protocol changes, and incident response.