Remote-First Senior AppSec Manager: Secure Web3 Apps

MetaMask; United States; Remote; USD 180,000 - 260,000; Full time

Job summary

MetaMask is seeking a Senior Manager, Application Security to lead security across the extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins and smart contracts. You will set strategy, guide threat modelling, and review code while managing a small senior team in a remote-first, global setup.

You will collaborate with engineering leadership to ensure risks are understood, owned, and remediated, and drive improvements to the secure development lifecycle with AI-enabled

Qualifications

• At least eight years in application security or software engineering with a security focus, including two years leading people.
• Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services.
• Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management.
• Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support.
• Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD.
• Experience running bug bounty and penetration testing programmes, including selecting and managing external providers.
• Working knowledge of EVM smart contract security, including common vulnerabilities and upgrade/administrator controls.
• A track record delivering security improvements through engineering teams outside your reporting line.
• Clear written communication, from threat models to risk summaries for executives.
• Offensive security qualifications such as OSCP, OSWE or OSWA, or proven bug bounty/CTF experience.
• Experience securing browser extensions or mobile applications.
• Experience securing development workflows that use AI, or AI components in production applications.
• Experience in crypto, Web3 or fintech/security-focused sectors.
• Knowledge of applied cryptography.
• Familiarity with state-actor attacks on software companies.

Responsibilities

• Lead and develop the Application Security team, including hiring, performance management and career development, while remaining involved in technical work.
• Define AppSec strategy, goals and OKRs; track KPIs and report progress to Security leadership.
• Define security review requirements, perform threat modelling, and oversee secure design across clients, APIs and backend services.

Skills

Code review

TypeScript/JavaScript

Go

Solidity

Browser extensions

Mobile applications

Backend services

Threat modelling

Secure SDLC

AI scanning

Tools

CI/CD pipelines

NPM / npm audit

Threat modelling tools

Job description

MetaMask is seeking a Senior Manager, Application Security to lead security across the extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins and smart contracts. You will set strategy, guide threat modelling, and review code while managing a small senior team in a remote-first, global setup.

You will collaborate with engineering leadership to ensure risks are understood, owned, and remediated, and drive improvements to the secure development lifecycle with AI-enabled