Senior Manager, Application Security

Consensys; United States; Remote; USD 180,000 - 240,000; Full time

Job summary

ConsenSys's MetaMask team is seeking a Senior Manager, Application Security to lead security across the extension, mobile app, Snaps, and backend services. You will shape the security strategy, direct a small senior team, and remain hands-on in code review and threat modelling.

You will work with the Head of Security and Engineering leadership to ensure risks are understood and addressed, oversee security reviews, threat modelling, supply chain controls, and secure design across authentication,

Qualifications

• Experience leading security teams and setting strategy.
• Strong threat modelling, risk assessment and design review.
• Hands-on review of code, architectures and dependencies.

Responsibilities

• Lead and develop the Application Security team, including hiring and performance management.
• Set the application security strategy, goals and quarterly OKRs.
• Report progress and gaps to Security leadership and Risk Committee.
• Define security review requirements across development and release, and address unresolved risks.
• Lead threat modelling and security design reviews across clients, APIs and backend services.
• Define software supply chain security requirements and validate controls.

Skills

Security leadership

Threat modelling

Code review

DevSecOps

Tools

OWASP

SCA tools

Job description

Please note that we are unable to consider applications from candidates based in France, Italy, or Germany for this role.

Money is moving onto the internet, and the shift has a name: Open Money. This is money that is open, portable, agentic, and owned by you. MetaMask spent the last ten years building it; with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Now we're building the operating system for your money: one place to hold, move, grow, and use anything you own. Join a remote-first, global team rebuilding how money works: a problem that touches everyone, every day.

About the role

MetaMask is a self-custody wallet that does not hold users’ private keys. Blockchain transactions are generally irreversible, meaning a vulnerability in the product or its software delivery chain can lead directly to financial losses for users. As a result, MetaMask attracts sustained attention from financially motivated attackers and sophisticated supply chain actors.

We are looking for a Senior Manager, Application Security to lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts.

The role covers architecture, code, dependencies, build and release controls, security testing, and vulnerability disclosure. This is a hands-on leadership role. You will set the strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modelling.

You will report to the Head of Security and work closely with MetaMask Engineering leadership to ensure security risks are understood, owned, and addressed.

Responsibilities

Leadership and planning

• Lead and develop the Application Security team, including hiring, performance management and career development, while remaining directly involved in technical work.
• Set the Application Security strategy, annual goals and quarterly OKRs in line with company objectives and the approved Target Operating Model.
• Report AppSec progress, coverage, remediation performance and material gaps to Security leadership and contribute to Risk Committee reporting.

Secure design and delivery

• Define security review requirements across development and release, assess whether they are met and escalated unresolved risks.
• Lead threat modelling and security design reviews across clients, APIs and backend services, including authentication, key management, signing and delegated actions. Assess trust boundaries across the full system and participate in architecture and RFC reviews.
• Define software supply chain security requirements and work with engineering teams to implement and validate controls for dependencies, builds, artefacts and publishing.
• Lead security code reviews across MetaMask applications and smart contracts, working with engineers and