Protocol Security Researcher

Openkrill; United States; Remote; USD 150,000 - 230,000; Full time

Job summary

Aave Labs is seeking a Protocol Security Researcher to bolster its internal security function. You will intersect smart contract security, protocol design, adversarial research, and AI-assisted review to reduce protocol risk continuously.

You will examine major changes before deployment, assess dependencies and integrations, and craft reusable security invariants and monitoring ideas for proactive defense.

Qualifications

• 5+ years of security experience in relevant field.
• Strong background in smart contract security and DeFi.
• Ability to review complex codebases and reason about protocol failures.
• Attacker mindset with ability to articulate exploit paths clearly.
• Experience with AI-assisted security tooling is a plus.
• Strong written communication for engineers and non-security stakeholders.
• Sound judgment on severity, exploitability, and material findings.

Responsibilities

• Review major protocol changes before audits or deployment.
• Perform attacker-driven analysis of contracts, mechanisms, and integrations.
• Influence security decisions through design discussions early.
• Identify risks in related systems: assets, oracles, adapters, dependencies.
• Contribute to AI-assisted security tooling and validate in reviews.
• Translate findings into reusable invariants and testing ideas.
• Collaborate with monitoring, incident response, and external auditors.

Skills

Security research experience

Smart contract security

Codebase review

Attacker mindset

DeFi mechanisms understanding

AI-assisted security tooling

Clear written communication

Risk assessment & trade-offs

Tools

Formal methods

Fuzzing

Invariant testing

Custom security tooling

Job description

About us

Aave Labs began with a simple question: how do we make financial services like borrowing, saving, and earning more accessible globally?

We built the Aave Protocol, now the world's largest and most trusted onchain lending market, connecting decentralized finance with individuals, traditional finance, and fintech.

Today, we build trusted, high-quality products that expand access to lending, credit, and savings globally

Our culture

We build trusted products that help people access and discover economic opportunities.

We hold a high bar for quality and craftsmanship. No detail is too small. Trust depends on it.

We're a global team building products people can actually use, turning complex technology into something simple and reliable.

We stay aligned, move quickly, and think long term, while keeping teams lean and focused on impact.

About the Role

Aave is looking for a Protocol Security Researcher to help build its internal protocol security function.

The role sits at the intersection of smart contract security, protocol design, adversarial research, and AI-assisted review. You will help assess major protocol changes before deployment, maintain security context across Aave's deployed systems, and reason about the risks introduced by critical dependencies, integrations, and Aave-adjacent infrastructure.

This is not a narrow audit role. The goal is to improve Aave's ability to understand and reduce protocol risk continuously.

How you can make an impact:

• Review major Aave protocol changes before external audit or deployment
• Perform attacker-driven analysis of smart contracts, protocol mechanisms, and integrations
• Participate in design and architecture discussions early enough to influence security-relevant decisions
• Identify risks in Aave-adjacent systems, including assets, bridges, oracles, adapters, and critical dependencies
• Contribute to AI-assisted security tooling and evaluate its effectiveness in real review workflows
• Turn review findings into reusable knowledge, invariants, assumptions, and testing or monitoring ideas
• Work with monitoring and incident response teams when review findings imply operational detection or response needs
• Collaborate with external auditors by helping define scope, known risks, and areas of concern

Let's connect if you have:

• 5+ years of relevant security experience
• Strong smart contract security background
• Ability to independently review complex codebases and reason about protocol-level failure modes
• Attacker mindset: you can move from “this looks wrong” to “this is how it could be exploited”
• Strong understanding of DeFi mechanisms, including lending, liquidations, accounting, oracles, collateral, governance, and integrations
• Evidence that you are actively using AI to improve security research, review quality, or review throughput
• Clear written communication: you can explain risk, impact, uncertainty, and trade-offs to engineers and non-security stakeholders
• Good judgment about severity, exploitability, and when a finding matters

Nice to haves:

• Experience with formal methods, fuzzing, invariant testing, or custom security tooling
• Experience building internal tools for security review, code understanding, or knowledge management
• Experience working with external audit firms or leading audit engagements
• Familiarity with governance payloads, upgrade systems, permissioning, and incident response
• Open-source security research, published findings, CTFs, bug bounties, or prior public vulnerability research

Equal opportunities statement:

Aave Labs celebrates diversity and views each and every team member as a separate individual with their own unique identity. No matter your race, religion, gender, ethnicity, age, disability, sexual orientation or even the wallet you use, we welcome you at Aave Labs. As an equal opportunities employer, we take accountability and believe in everyone's potential to build, create and inspire changes. With a mission to build a diverse workforce, we are proud to foster a working environment in which everyone can feel safe and valued for who they are.