Application Security Engineer

This is a fully remote position, open to applicants in Gibraltar.

📋 Description

• Conduct security assessments of source code, smart contracts, and protocol modifications across all RootstockLabs projects.

• Engage in design and architecture evaluations, as well as threat modeling new products and features alongside development teams.

• Evaluate and prioritize bug bounty submissions, determine severity levels, and facilitate remediation efforts in collaboration with engineering.

• Partner with external security audits, define engagement scopes, and liaise with third-party auditors until all findings are resolved.

• Develop and maintain security automation tools, including AI-driven code reviews, scanning, and findings-triage processes.

• Investigate attack methods pertinent to EVM, bridges, and peer-to-peer systems, converting insights into monitoring alerts, CI security checks, and hardening measures.

• Assist in incident investigations that involve application-layer vulnerabilities.

⛳️ Requirements

• Over 3 years of experience in Application Security or Security Engineering.

• Strong understanding of common vulnerability categories (OWASP Top 10).

• Proficient in secure code review for Java, along with at least one of the following: TypeScript/JavaScript, Python, Go, or Rust.

• Practical experience in blockchain security, including smart contract auditing (Solidity/EVM) or protocol/node-level security.

• Proven experience in developing and managing security automation systems.

• Familiarity with AI-assisted workflows, such as LLM-based triage, code reviews, or scanning processes.

• Knowledge of SAST/DAST, dependency and secret scanning, and CI/CD security checkpoints.

• Proficient in English.

• Background and reference checks will be conducted as part of the hiring process.

🏝️ Benefits

• Competitive salary package along with distinctive benefits aimed at fostering your growth and well-being.

• Fully remote work available within the Central European to Argentinian time-zone range (UTC-3 to UTC+2, with roughly an hour's flexibility on either side).

• Access to worldwide coworking spaces.

• Paid vacation and sick leave entitlement.

• Opportunities for training programs, language courses, and annual learning sponsorship.

• Collaborate with advanced blockchain technology in a globally diverse team.