Remote Security Engineer, Web3 & Bug Bounty Programs

Mysten Labs, Inc.; United States; Remote; USD 150,000 - 230,000; Full time

Job summary

Mysten Labs, Inc. is seeking a hands-on Security Engineer to own bug bounty programs, external audits, and secure our code and software supply chain across the Sui ecosystem. You will review systems built in Rust, TypeScript, Move and contribute to incident response and remediation.

The role emphasizes code security, vulnerability research, and proactive tooling, with a remote-first team hiring globally. Strong cryptography and supply-chain expertise are valued in this fast-moving web3

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, or equivalent practical experience.
• 3+ years hands-on experience in security engineering, application security or product security with a track record of finding real vulnerabilities.
• Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures.
• Proficiency in Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code.
• Experience on either side of a bug bounty program or an audit engagement.

Responsibilities

• Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts.
• Own audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation.
• Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move). Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs.
• Own software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service.
• Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations.
• Build security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review. Build in known-clean checks so people trust the results.

Skills

Web3 security

Bug bounty

Audit experience

Security engineering

Education

Bachelor's degree in CS/CE or related field

Tools

CodeQL

Semgrep

LLM tooling

GitHub Actions

Job description

Mysten Labs, Inc. is seeking a hands-on Security Engineer to own bug bounty programs, external audits, and secure our code and software supply chain across the Sui ecosystem. You will review systems built in Rust, TypeScript, Move and contribute to incident response and remediation.

The role emphasizes code security, vulnerability research, and proactive tooling, with a remote-first team hiring globally. Strong cryptography and supply-chain expertise are valued in this fast-moving web3