Security Engineer

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Manage Mysten's bug bounty initiatives, encompassing triage, severity evaluation, response handling, internal escalations, fix validation, budget management, and payouts.

• Convert recurring classes of bug bounty reports into automated checks.

• Take ownership of audit engagements by defining scopes and scheduling external audits, acting as the technical liaison, and monitoring findings through to remediation and validation of fixes.

• Perform code and design reviews of systems developed by Mysten, its subsidiaries, and partners utilizing Rust, TypeScript, and Move.

• Propel security issues towards resolution, which includes investigation and incident response.

• Execute variant analysis to address each bug class wherever it appears.

• Oversee software supply chain security, which includes defenses against dependency and CI/CD malware, Endor Labs, GitHub controls, merge bots, and self-auditing for code security.

• Identify and respond to compromised packages, maintainers, and build pipelines.

• Ensure secure provenance and signing of deployed software.

• Develop and enhance anti-scam and anti-abuse tools for the Sui ecosystem.

• Identify phishing sites, malicious dApps, drainer contracts, and other threats targeting Sui users.

• Collaborate with wallet teams on implementing mitigations.

• Create security tools including LLM-driven triage and review agents, static and dynamic analysis, taint analysis, call graphs, and fuzzing, integrated into CI and code review processes.

• Establish known-clean checks to enhance trust in security tools.

⛳️ Requirements

• A Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.

• Over 3 years of hands-on experience in security engineering, application security, or product security.

• Proven track record of identifying genuine vulnerabilities, such as through bug bounty reports, audit findings, CVEs, or published research.

• Strong fundamental knowledge of Web2 security concepts, including XSS, CSRF, SSRF, authorization vulnerabilities, injection attacks, deserialization issues, software supply chain failures, and cryptographic failures.

• Proficient in one or more programming languages such as Rust, TypeScript, Python, or Move.

• Experience in reviewing and writing security-sensitive code.

• Practical knowledge of software supply chain attack vectors, including npm, crates.io, PyPI, GitHub Actions workflow injection, token exposure, unpinned actions, and build provenance.

• Solid understanding of applied cryptography principles and common cryptographic misapplications.

• Experience on either side of a bug bounty program or audit engagement.

• Excellent written and verbal communication skills, with the ability to influence teams without formal authority.

• A keen interest in the web3 space is essential.

• Employment is contingent upon a successful background check, potentially including verification of employment history, educational credentials, and criminal history.

🏝️ Benefits

• Tokens + equity compensation.

• Comprehensive benefits package.

• Eligibility to participate in annual equity and token refresh grant programs.

• Comprehensive health insurance covering medical, dental, and vision for employees and their dependents.

• Tax-saving benefits, including HSAs and FSAs.

• 18 weeks of paid parental leave.

• Wellbeing programs, including family planning support, gender-affirming care, hormone replacement therapy, and access to physical fitness/nutrition applications.

• Mental health support and counseling services.

• Employee Assistance Program providing financial/legal assistance and home life referrals.

• Coverage for short-term and long-term disability.

• Life and accident insurance.

• Traveler insurance coverage.

• 401(k) plan.

• Complimentary privacy protection services.

• Wellness stipend.

• Flexible paid time off.

• 11 paid holidays annually.

• Team offsites and an annual all-company retreat.