Security Engineer - Web3, Audits & Bug Bounty

Mysten Labs, Inc.; Oregon; Hybrid; USD 150,000 - 210,000; Full time

Job summary

Mysten Labs is seeking a hands-on Security Engineer with strong application security fundamentals to own bug bounty programs and external audits. You will secure code and the supply chain across the Sui ecosystem and build tooling for anti-scam and abuse protections.

You will review systems built in Rust, TypeScript, and Move, lead security initiatives, and collaborate with teams globally in a remote-first environment. Background checks apply, and web3 interest is required.

Qualifications

• Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
• 3+ years of hands-on experience in security engineering, application security or product security with a track record of finding real vulnerabilities.
• Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, supply chain and cryptographic failures.

Responsibilities

• Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and budgets.
• Own audit engagements: scope & schedule external audits, act as technical counterpart, track findings through remediation and fix validation.
• Conduct code and design reviews of systems (Rust, TypeScript, Move); drive issues to conclusion and incident response.
• Own software supply chain security: dependencies, CI/CD malware defenses, code security services, secure provenance and signing of Mysten ships.
• Build/improve anti-scam and anti-abuse tooling for the Sui ecosystem; detect phishing sites, malicious dApps, drainer contracts, and mitigations with wallet teams.
• Build security tooling: LLM-driven triage and review, static/dynamic analysis wired into CI and code review, and known-clean checks.

Skills

Security engineering

Web2 security fundamentals

Rust/TypeScript/Python/Move

Security review of code

Education

Bachelor's degree in Computer Science or related field

Tools

GitHub Actions

CI/CD tooling

Job description

Mysten Labs is seeking a hands-on Security Engineer with strong application security fundamentals to own bug bounty programs and external audits. You will secure code and the supply chain across the Sui ecosystem and build tooling for anti-scam and abuse protections.

You will review systems built in Rust, TypeScript, and Move, lead security initiatives, and collaborate with teams globally in a remote-first environment. Background checks apply, and web3 interest is required.