Senior Manager, Application Security

This is a fully remote position, open to applicants in Europe.

📋 Description

• Oversee application security for the MetaMask extension, mobile application, Snaps, backend services, DeFi primitives, stablecoins, and associated smart contracts.

• Establish application security strategy, set annual goals, quarterly OKRs, KPIs, and operational framework.

• Lead and nurture the Application Security team, encompassing hiring, performance evaluation, and career progression.

• Communicate AppSec advancements, coverage, remediation efficacy, and significant gaps to Security leadership, and contribute to Risk Committee documentation.

• Specify security review criteria for development and release processes and escalate unresolved risks.

• Conduct threat modeling and security design assessments across clients, APIs, and backend services.

• Define and verify software supply chain security measures for dependencies, builds, artifacts, and publishing procedures.

• Direct security code evaluations for MetaMask applications and smart contracts.

• Enhance secure development lifecycle protocols for AI agents, AI development tools, generated code, and AI product components.

• Incorporate and validate static and dynamic analysis, dependency scanning, secrets detection, and AI scanning methodologies.

• Provide secure coding guidance, reusable libraries, training, and support for the security champions program.

• Manage vulnerability assessments, including triage, prioritization, remediation tracking, verification of fixes, and escalation processes.

• Oversee bug bounty programs, penetration testing, AI security scanning, external provider management, researcher engagements, rewards, payouts, and vulnerability disclosures.

• Supply application security documentation for audits and assurance reviews, and assist with customer and partner due diligence.

• Offer application security expertise during incidents, including vulnerability evaluation and remediation assistance.

• Report directly to the Head of Security and collaborate closely with MetaMask Engineering leadership.

⛳️ Requirements

• A minimum of eight years in application security or software engineering with a focus on security, including two years in a leadership role.

• Strong practical skills in code reviews for TypeScript/JavaScript, Go, or Solidity across browser extensions, mobile applications, and backend services.

• Demonstrated experience in securing applications across clients and backend services, including distributed authentication, authorization, and key management.

• Experience in establishing or significantly enhancing an AppSec program, covering security reviews, automated testing, AI scanning, vulnerability management, and developer support.

• Practical knowledge in securing software supply chains, including dependency policies, software composition analysis, npm, artifact integrity, and CI/CD processes.

• Experience in managing bug bounty and penetration testing programs, including the selection and oversight of external providers.

• Familiarity with EVM smart contract security.

• Proven track record of delivering security enhancements through engineering teams outside of the reporting structure.

• Strong written communication skills.

• Preferred qualifications: OSCP, OSWE, or OSWA; experience in browser extension or mobile application security; AI security; knowledge of crypto/Web3 or similarly targeted sectors; applied cryptography; understanding of state-actor attacks; experience with SOC 2 or ISO 27001 documentation.

• Applicants may need to undergo background and identity verification checks.

• Applications from candidates located in France, Italy, or Germany cannot be considered.

🏝️ Benefits

• Remote-first, global team environment.

• Equal opportunity employer.

• Background and identity verification checks as required.

• Human review of AI-assisted recruitment decisions.