Role overview
Strengthen security across both organizational operations and the products being built. The work combines hands-on engineering with operational ownership, spanning identity and access, software reviews, security tooling, and coordination of external assessments.
Responsibilities
- Manage identity and access, including account provisioning, lifecycle changes, and monitoring important updates.
- Review products through threat modeling, code review, fuzzing, and functional testing.
- Run bug bounty operations, triage reports, and follow remediation of serious findings.
- Build reusable methods and tools for adversarial testing of AI agent controls.
- Monitor software supply-chain risks, including malicious packages beyond standard vulnerability scanning.
- Coordinate external penetration tests and track remediation; prepare compliance evidence as needs arise.
Requirements
- At least five years of professional experience, with meaningful software engineering experience building production systems before transitioning into security.
- Product or application security experience across threat modeling, secure design, white-box code review, and vulnerability testing.
- Proficiency in a systems or backend language such as Rust, Go, C++, or Python, and willingness to read production code and build tools.
- Experience creating security automation and conducting security reviews of production software.
- Understanding of identity and access management, software supply-chain risk, and AI security testing.
- Clear written communication and the ability to work autonomously with high ownership.
Nice to have
- Experience in web3, cryptocurrency, or DeFi.
- Familiarity with enterprise identity and SSO, privileged access management, Linux hardening, multisignature key management, hardware security modules, or trusted execution environments.
Benefits and work setup
Remote-first, writing-heavy work with open communication. Compensation includes salary and token incentives.