Manager, Application Security

MetaMask; United States; Remote; USD 180,000 - 260,000; Full time

Job summary

MetaMask is seeking a Senior Manager, Application Security to lead security across the extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins and smart contracts. You will set strategy, guide threat modelling, and review code while managing a small senior team in a remote-first, global setup.

You will collaborate with engineering leadership to ensure risks are understood, owned, and remediated, and drive improvements to the secure development lifecycle with AI-enabled

Qualifications

• At least eight years in application security or software engineering with a security focus, including two years leading people.
• Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services.
• Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management.
• Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support.
• Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD.
• Experience running bug bounty and penetration testing programmes, including selecting and managing external providers.
• Working knowledge of EVM smart contract security, including common vulnerabilities and upgrade/administrator controls.
• A track record delivering security improvements through engineering teams outside your reporting line.
• Clear written communication, from threat models to risk summaries for executives.
• Offensive security qualifications such as OSCP, OSWE or OSWA, or proven bug bounty/CTF experience.
• Experience securing browser extensions or mobile applications.
• Experience securing development workflows that use AI, or AI components in production applications.
• Experience in crypto, Web3 or fintech/security-focused sectors.
• Knowledge of applied cryptography.
• Familiarity with state-actor attacks on software companies.

Responsibilities

• Lead and develop the Application Security team, including hiring, performance management and career development, while remaining involved in technical work.
• Define AppSec strategy, goals and OKRs; track KPIs and report progress to Security leadership.
• Define security review requirements, perform threat modelling, and oversee secure design across clients, APIs and backend services.

Skills

Code review

TypeScript/JavaScript

Go

Solidity

Browser extensions

Mobile applications

Backend services

Threat modelling

Secure SDLC

AI scanning

Tools

CI/CD pipelines

NPM / npm audit

Threat modelling tools

Job description

Описание

Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role. Money is moving onto the internet, and the shift has a name: Open Money. This is money that is open, portable, agentic, and owned by you. MetaMask spent the last ten years building it; with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Now we're building the operating system for your money: one place to hold, move, grow, and use anything you own. Join a remote-first, global team rebuilding how money works: a problem that touches everyone, every day. MetaMask is a self-custody wallet that does not hold users’ private keys. Blockchain transactions are generally irreversible, meaning a vulnerability in the product or its software delivery chain can lead directly to financial losses for users. As a result, MetaMask attracts sustained attention from financially motivated attackers and sophisticated supply chain actors. We are looking for a Senior Manager, Application Security to lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts. The role covers architecture, code, dependencies, build and release controls, security testing, and vulnerability disclosure. This is a hands-on leadership role. You will set the strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modelling. You will report to the Head of Security and work closely with MetaMask Engineering leadership to ensure security risks are understood, owned, and addressed.

Задачи

Leadership and planning

Lead and develop the Application Security team, including hiring, performance management and career development, while remaining directly involved in technical work. Set the Application Security strategy, annual goals and quarterly OKRs in line with company objectives and the approved Target Operating Model. Define and track KPIs to measure performance and progress. Report AppSec progress, coverage, remediation performance and material gaps to Security leadership and contribute to Risk Committee reporting.

Secure design and delivery

Define security review requirements across development and release, assess whether they are met and upscale unresolved risks. Lead threat modelling and security design reviews across clients, APIs and backend services, including authentication, key management, signing and delegated actions. Assess trust boundaries across the full system and participate in architecture and RFC reviews. Define software supply chain security requirements and work with engineering teams to implement and validate controls for dependencies, builds, artefacts and publishing. Lead security code reviews across MetaMask applications and smart contracts, working with engineers and relevant specialists to address findings. Define and evolve the secure development lifecycle to incorporate AI agents, including their access, actions and human review requirements. Set security standards for AI development tools, generated code and AI components in products. Integrate security testing into development and delivery workflows, including static and dynamic analysis, dependency scanning, secrets detection and AI scanning. Evaluate tools and validate their findings. Help engineers prevent recurring vulnerabilities through secure coding guidance, reusable libraries, training and the security champions programme.

Vulnerability management and external testing

Own application vulnerability assessment, triage, prioritisation and remediation tracking within the organisation’s vulnerability management framework. Correlate findings across clients, services and supporting infrastructure with the relevant owners to assess combined impact. Ensure findings have clear owners and deadlines, verify fixes and elevate overdue risks. Set the scope and proposed investment for bug bounty, penetration testing and AI security scanning based on risk and results. Manage external providers, researcher relationships, rewards and payouts, and coordinate vulnerability disclosure.

Assurance and incident support

Provide evidence of application security controls for audits and assurance reviews, and support customer and partner due diligence. Provide application security expertise during incidents, including vulnerability analysis and remediation support.

Требования

Required:

• At least eight years in application security or software engineering with a security focus, including two years leading people.
• Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services, with the ability to identify vulnerabilities and work with engineers to fix them.
• Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management.
• Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support, with sound judgement on where AI adds value and how to validate its findings.
• Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD.
• Experience running bug bounty and penetration testing programmes, including selecting and managing external providers.
• Working knowledge of EVM smart contract security, including common vulnerabilities, review methods, upgrade and administrator controls, and assessing external audits.
• A record of delivering security improvements through engineering teams outside your reporting line.
• Clear written communication, from actionable threat models to concise summaries of risk for executives.
• Offensive security qualifications such as OSCP, OSWE or OSWA, or a proven record in bug bounty programmes or CTF competitions.
• Experience securing browser extensions or mobile applications.
• Experience securing development workflows that use AI, or AI components in production applications.
• Experience in crypto, Web3 or another sector facing sustained attacks, such as fintech, payments or infrastructure.
• Knowledge of or a strong interest in applied cryptography.
• Familiarity with attacks by state actors against software companies, particularly DPRK supply chain and social engineering campaigns.
• Experience providing evidence of secure development controls for SOC 2 or ISO 27001 assessments.

MetaMask is an equal opportunity employer. All employment decisions are made without regard to race, color, national origin, ancestry, sex, gender, gender identity or expression, sexual orientation, age, genetic information, religion, disability, medical condition, pregnancy, marital status, family status, veteran status, or any other characteristic protected by law.

It is a requirement of employment in this position that applicants may be required to submit to background and identity verification checks, including but not limited to employment, education, criminal record checks, and other such checks as determined necessary by the company.

MetaMask may use artificial intelligence tools to support parts of our recruitment process, such as reviewing applications, screening resumes, or conducting initial candidate assessments. These tools are designed to assist our recruiting team and improve efficiency — they do not replace human judgment. A human recruiter or hiring manager reviews every candidate, and all final hiring decisions are made by people, not AI.