Senior Security Engineer, DeFi

This is a fully remote position, open to applicants in United States, +1 more country.

📋 Description

• Develop and maintain continuous monitoring of the Sui DeFi ecosystem to assess security and economic risks.

• Enhance the security team's tools, incorporating accurate static analysis software and proprietary agent skills.

• Evaluate and promote adherence to DeFi security guidelines across supported protocols.

• Execute regular compliance cycles, produce protocol report cards, verify security assertions against on-chain data, track remediation commitments, and escalate regressions or undisclosed incidents.

• Identify critical vulnerabilities in high-TVL Sui protocols via comprehensive audits, variant analysis across forks, pre-execution reviews of multisig upgrade payloads, and incident forensics.

• Act as the security team’s liaison for external DeFi teams and Mysten's DeFi products, including DeepBook.

• Conduct due diligence, manage incident coordination, and oversee post-mortem analyses.

• Prepare findings, reports, and runbooks that are actionable for protocol engineers and accessible to non-technical stakeholders.

• Ensure claims can be traced back to bytecode, chain state, or data.

⛳️ Requirements

• Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.

• Over 3 years of practical experience in security engineering, smart contract security, or DeFi risk engineering.

• Proven history of developing production tools and uncovering actual vulnerabilities through audit reports, bug bounty submissions, published research, or incident response work.

• In-depth understanding of DeFi mechanics and potential failure modes, including lending markets, AMMs, concentrated liquidity, perpetuals, liquid staking, oracles, flash loans, and MEV.

• Proficient in TypeScript and Python.

• Familiarity with Rust.

• Capability to write SQL queries over large datasets and work with blockchain indexers and data warehouses.

• Experience reading smart contract code at the source, bytecode, or disassembly level, or demonstrable ability to learn it quickly.

• Diligence in verifying claims against bytecode and chain state and documenting unverified elements.

• Excellent written and verbal communication skills, with the ability to influence external teams without formal authority.

• A genuine interest in the web3 space is required.

• Employment is contingent upon a successful background check, which may include employment history, educational credentials, criminal history, and other relevant details.

• Experience with Sui and Move is preferred.

• Familiarity with recent DeFi exploit history on Sui and other chains is preferred.

• Experience in developing analysis or monitoring tools using LLM agents is preferred.

• Experience with static or dynamic program analysis is preferred.

• Background in quantitative or economic modeling is preferred.

• Publications, conference presentations, CVEs, or bug bounty rankings are preferred.

🏝️ Benefits

• Tokens and equity compensation.

• Eligibility to participate in annual equity and token refresh grant programs.

• Comprehensive medical, dental, and vision insurance coverage for employees and their dependents.

• Health Savings Accounts (HSAs) and Flexible Spending Accounts (FSAs).

• 18 weeks of paid parental leave.

• Wellbeing programs, including family planning support, gender-affirming care, hormone replacement therapy, and physical fitness/nutrition applications.

• Mental health support and counseling services.

• Employee Assistance Program (EAP) offering financial/legal assistance and home life referrals.

• Short-term and long-term disability coverage.

• Life and accident insurance.

• Traveler insurance.

• 401(k) plan.

• Complimentary privacy protection service.

• Wellness stipend.

• Flexible paid time off.

• 11 paid holidays each year.

• Team offsites and an annual all-company retreat.