SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Mysten Labs is seeking a hands-on Security Engineer to own application security across its blockchain infrastructure and products, including Sui, Move, and the emerging agent economy ecosystem. This is a senior individual contributor role with broad scope across multiple security domains.
Key Responsibilities:
- Manage Mysten's bug bounty programs end-to-end: triage and severity assessment, response coordination, internal escalations, fix validation, budget management, and payouts. Identify recurring vulnerability classes and build automated detection.
- Own external audit engagements: scope and schedule audits with third parties, serve as technical lead during engagements, track findings through remediation, and validate fixes.
- Conduct code and design reviews across Mysten's codebase and partner systems (Rust, TypeScript, Move). Drive vulnerability investigation and incident response to closure, perform variant analysis to ensure each bug class is eliminated everywhere it appears.
- Secure the software supply chain: manage dependency and CI/CD malware defenses, oversee Endor Labs integration, manage code security services (GitHub controls, merge bots), and operate the code security self-auditing service. Detect and respond to compromised packages, maintainers, and build pipelines; secure provenance and signing of shipped artifacts.
- Build anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts, and other threats targeting Sui users; collaborate with wallet teams on mitigations.
- Develop security tooling: create LLM-driven triage and review agents, implement static and dynamic analysis (taint analysis, call graphs, fuzzing) integrated into CI and code review workflows. Build confidence mechanisms so teams trust automated results.
The role is part of a remote-first, globally distributed team at a well-funded web3 infrastructure company.
Minimum Qualifications:
- Bachelor's degree in Computer Science, Computer Engineering, or relevant technical field (or equivalent practical experience).
- 3+ years of hands-on security engineering, application security, or product security with a demonstrated track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs, or published research).
- Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures.
- Proficiency in one or more of Rust, TypeScript, Python, or Move; experience reviewing and writing security-sensitive code.
- Hands-on knowledge of software supply chain attack surface: package ecosystems (npm, crates.io, PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance.
- Solid understanding of applied cryptography fundamentals and common misuse patterns in practice.
- Experience on either side of a bug bounty program or audit engagement.
- Strong written and verbal communication; ability to influence teams without formal authority.
- Required: Interest in the web3 space.
Preferred Qualifications:
- Smart contract or wallet security experience: Move, Solidity, or Rust-based chains; familiarity with Sui's object and capability model.
- Static or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution.
- Experience building security tooling with LLM agents (Claude Code or comparable); clear judgment about where models help versus deterministic tooling.
- Anti-phishing, anti-fraud, or trust & safety background: domain and content monitoring, crawling, classifiers, threat intelligence.
- Knowledge of recent crypto incidents and underlying defect classes: drainer kits, DeFi frontend compromises, package-registry compromises.
- Notable bug bounty rankings, CVEs, publications, or conference talks.
