Security Engineer

mystenlabs; United States; Remote; USD 180,000 - 250,000; Full time

Benefits offered by this job

Remote work across the world

Job summary

Mysten Labs seeks an experienced security leader to own application and product security for blockchain infrastructure and related developer and user products. You will oversee vulnerability reporting, audits, secure code, and build-provenance defenses across pipelines.

You will run bug bounty operations, plan external audits, review security-sensitive code in Rust, TypeScript, and Move, and collaborate with wallet teams to mitigate phishing and drainer risks.

Qualifications

• At least three years in security roles with vulnerability findings through reports, audits, CVEs, or research.
• Strong understanding of vulnerabilities, supply-chain risks, and crypto failures.
• Experience reviewing or writing security-sensitive code in Rust, TypeScript, Python, or Move.
• Hands-on with package ecosystems, CI/CD security, and build provenance.
• Experience participating in bug bounty programs or security audits; strong communication skills.
• Degree or equivalent practical experience; interest in web3.

Responsibilities

• Run bug bounty operations from triage to payouts and automate safeguards.
• Plan external security audits, support technical reviews, and track fixes through validation.
• Review designs and security-sensitive code in Rust, TypeScript, and Move; investigate incidents for vulnerabilities.
• Strengthen dependency, CI/CD, and build-provenance defenses and detect compromised packages or pipelines.
• Develop ways to identify phishing sites, malicious dApps, and drainer contracts; coordinate mitigations with wallet teams.
• Build security analysis tooling with static/dynamic checks and AI-assisted workflows.

Skills

Security expertise

Vulnerability discovery

Bug bounty experience

Cryptographic understanding

CI/CD security

Education

Relevant degree or equivalent experience

Tools

Rust

TypeScript

Move

Python

Job description

Role overview

Own application and product security for blockchain infrastructure and related developer and user products. The work spans vulnerability reporting and audits, secure code and software supply chains, incident response, and tools that help protect users from scams and abuse.

Responsibilities

• Run bug bounty operations, from triage and severity decisions to remediation checks and payouts; turn recurring findings into automated safeguards.


• Plan external security audits, support technical reviews, and track issues through fixes and validation.


• Review designs and security-sensitive code in Rust, TypeScript, and Move; investigate incidents and check for related vulnerabilities across systems.


• Strengthen dependency, CI/CD, and build-provenance defenses, including detecting compromised packages, maintainers, or pipelines.


• Develop ways to identify phishing sites, malicious decentralized applications, and drainer contracts, and coordinate mitigations with wallet teams.


• Build security analysis and review tooling, including static and dynamic checks and AI-assisted workflows integrated into development.

Requirements

• At least three years in security, application security, or product security, with evidence of finding real vulnerabilities through reports, audits, CVEs, or research.


• Strong understanding of common application vulnerabilities, supply-chain risks, and practical cryptographic failures.


• Proficiency in at least one of Rust, TypeScript, Python, or Move, with experience reviewing or writing security-sensitive code.


• Hands-on knowledge of package ecosystems, CI/CD security, and build provenance.


• Experience participating in a bug bounty program or security audit, plus clear written and verbal communication skills.


• A relevant degree or equivalent practical experience, and interest in web3.

Nice to have

Smart contract or wallet security experience; familiarity with CodeQL, Semgrep, fuzzing, taint analysis, or symbolic execution; AI-assisted security tooling; anti-phishing or fraud work; knowledge of crypto attack patterns; or public security contributions such as rankings, CVEs, publications, or talks.

Benefits and work setup

The team works remotely and hires across the world.