Security Engineer

📋 Description

• Oversee and enhance the custody systems responsible for managing validator keys, operational keys, and critical objects for Mysten-operated smart contracts and general on-chain activities, which include key generation, storage, access controls, signing workflows, aggregation, rotation, and recovery procedures.

• Strengthen the signing process end-to-end: assess and refine the code, infrastructure, and operational practices that govern how transactions are authorized, reviewed, and submitted on-chain.

• Develop and enhance anti-scam and anti-abuse tools for the Sui ecosystem, identifying phishing websites, harmful dApps, drainer contracts, and other threats aimed at Sui users, while collaborating with wallet ecosystem teams on mitigation strategies.

• Perform code and design reviews of components that interact with sensitive keys or manage on-chain assets, emphasizing cryptographic accuracy, access control, and operational safety.

• Take part in the investigation and response efforts for security issues and incidents related to custody or ecosystem abuse, and implement concrete solutions that prevent similar issues from arising in the future.

⛳️ Requirements

• A minimum of 3 years of practical experience in security engineering, application security, or product security.

• Knowledge pertinent to key management in production environments, such as HSMs, cloud KMS, MPC or threshold-signature systems, hardware wallets, or equivalent custody infrastructure.

• Proficient in one or more programming languages: Rust, TypeScript, Python, or Move, with experience in reviewing and writing security-sensitive code.

• A solid grasp of applied cryptography principles and the typical ways cryptographic systems can be misused in real-world applications.

• A builder mindset: comfortable working in ambiguity, exploring unfamiliar codebases, and implementing fixes independently rather than delegating.

• Excellent written and verbal communication skills: able to clearly articulate findings or issues to engineers who need to address them and to non-technical stakeholders who need to comprehend the associated risks.

• A genuine interest in the web3 space is essential; previous experience in crypto, fintech, or other regulated/high-stakes environments is an advantage.

🏝️ Benefits

• Comprehensive health insurance that covers medical, dental, and vision for you and your dependents, including Tax Savings Benefits such as HSAs and FSAs.

• 18 weeks of paid Parental Leave.

• Free access to wellness programs, including family planning support, gender-affirming care, and hormone replacement therapy, as well as physical fitness/nutrition apps. We also offer mental health support, counseling, and an Employee Assistance Program (EAP) for financial/legal guidance, home life referrals, and more.

• Coverage for Short Term and Long Term Disability, Life Insurance, Accident Insurance, and other coverage options.

• Traveler Insurance.

• 401(k) plan.

• Complimentary privacy protection service.

• Wellness stipend.

• Flexible paid time off alongside 11 paid holidays each year.

• Team offsites and an annual company-wide retreat.