140K–190K USD / year
Security Engineer
OtherRemote — USA, Canada
Published on 2026-10-20
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Mysten Labs is hiring a hands-on Security Engineer to find and remediate vulnerabilities across its products and the Sui ecosystem. The role spans application security, bug bounty and audit ownership, software supply chain protection, anti-abuse tooling, and security automation.
About the company
Mysten Labs is a technology company specializing in blockchain and decentralized finance solutions. They focus on developing infrastructure and products that enhance the interoperability and efficiency of digital assets for developers and enterprises.
The team
Security
Stack
RustTypeScriptPythonMoveGitHub ActionsEndor LabsCodeQLSemgrep
What you'll do
- Manage bug bounty triage, escalations, remediation validation, budgets, and payouts.
- Scope and coordinate external security audits, tracking findings through remediation.
- Review code and designs, investigate incidents, and perform variant analysis.
- Secure dependencies, CI/CD pipelines, build provenance, and artifact signing.
- Develop anti-phishing, anti-scam, and anti-abuse tools for the Sui ecosystem.
- Build security automation, including LLM-assisted review, static and dynamic analysis, and CI-integrated tooling.
What we're looking for
- At least 3 years of hands-on application, product, or security engineering experience with demonstrated vulnerability findings.
- Strong application security fundamentals, including web vulnerabilities, supply chain risks, and cryptographic misuse.
- Proficiency in at least one of Rust, TypeScript, Python, or Move, with experience reviewing security-sensitive code.
- Hands-on knowledge of package ecosystem and CI/CD attack surfaces and build provenance.
- Applied cryptography fundamentals and experience with a bug bounty program or security audit.
- Strong written and verbal communication; interest in web3 is required.
- Bachelor's degree in a relevant technical field or equivalent practical experience.
Nice to have
- Smart contract or wallet security experience, especially with Move or Sui's object and capability model.
- Experience with static or dynamic analysis, fuzzing, or symbolic execution.
- Experience building security tooling with LLM agents.
- Anti-phishing, anti-fraud, trust and safety, or crypto incident response experience.
- Notable bug bounty rankings, CVEs, publications, or conference talks.
Benefits
- Tokens and equity compensation, with eligibility for annual refresh grants.
- Medical, dental, and vision insurance for employees and dependents.
- 18 weeks of paid parental leave.
- 401(k), wellness stipend, and flexible paid time off with 11 paid holidays.
- Team offsites and an annual company retreat.