Senior Security Engineer

mystenlabs; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Mysten Labs is seeking a Senior Security Engineer to build and operate security systems for endpoints, cloud, identity, and production services. The role covers large-scale telemetry, detection, incident response, and platform development.

You will lead threat hunting, insider-risk investigations, and incident response from triage to forensics, and help engineers design secure architectures across Kubernetes, CI, and cloud environments. Strong scripting in Python/Go is expected.

Qualifications

• At least five years in security engineering, detection and response, or infrastructure/SRE with a security focus.
• Hands-on experience with EDR, detections tuning, and macOS/Linux internals.
• Telemetry pipelines, SIEM or security data lake at terabyte scale; strong SQL.
• Production engineering with Linux, containers, Kubernetes, cloud platforms, IaC, monitoring.
• Proficiency in Python or Go; openness to Rust; familiarity with SSO, MFA, device trust.
• Strong written communication and incident reporting; interest in web3.

Responsibilities

• Develop and operate a security data platform for high-volume telemetry, including ingestion, normalization, retention, queries, and tested detection logic.
• Manage endpoint protections such as EDR, binary authorization, and hardening baselines across the device fleet.
• Lead threat hunting, insider-risk investigations, and incident response from triage to forensics and preventive controls.
• Build and run security services for identity/access, app proxying, blocking, asset inventory, developer workflows, and compliance automation.
• Operate agent-based automation for security triage and investigation with deterministic checks for verification.
• Review cloud, Kubernetes, bare-metal, and CI infrastructure designs; run adversary simulations and implement fixes/detections.
• Write actionable runbooks and incident reviews to support teams under pressure.

Job description

Role overview

Build and operate security systems that protect endpoints, cloud infrastructure, identity, and production services. The work spans large-scale security telemetry and detection, incident response, security platform development, and helping engineering teams make secure design choices.

Responsibilities

• Develop and operate a security data platform for high-volume telemetry, including ingestion, normalization, retention, queries, and tested detection logic.
• Manage endpoint protections such as EDR, binary authorization, and hardening baselines across the device fleet.
• Lead threat hunting, insider-risk investigations, and incident response from triage and containment through forensics, root-cause analysis, and preventive controls.
• Build and run security services for identity and access, application proxying, blocking, asset inventory, developer workflows, and compliance automation.
• Operate agent-based automation for security triage and investigation, using deterministic checks where model output needs verification.
• Review cloud, Kubernetes, bare-metal, and CI infrastructure designs; run adversary simulations and turn findings into fixes and detections.
• Write actionable runbooks and incident reviews that support teams responding under pressure.

Requirements

• At least five years in security engineering, detection and response, or infrastructure/SRE with a security focus, including hands-on endpoint and cloud incident response.
• Experience operating EDR and tuning detections, with practical knowledge of macOS and Linux attack techniques and internals.
• Experience with telemetry pipelines and a SIEM or security data lake at terabyte scale; strong SQL for querying and detection work.
• Production engineering experience with Linux, containers, Kubernetes, a major cloud platform, infrastructure as code, monitoring, and alerting.
• Proficiency in Python or Go; willingness to work with Rust; familiarity with SSO, phishing-resistant MFA, device trust, and token or session theft.
• Strong written communication, including incident coordination and post-incident reporting; interest in web3 is required.
• A relevant technical degree or equivalent practical experience.

Nice to have

• Experience with zero-trust access, identity-aware proxies, policy engines, or fleet-wide binary authorization.
• Digital forensics, malware analysis, or familiarity with threats targeting crypto organizations and their supply chains.
• Security tooling that uses LLM agents, compliance automation, or work in ISO 27001 or SOC 2 environments.
• Security publications, conference talks, or open-source tooling.