SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
MetaMask, a self-custody blockchain wallet with 100M+ downloads and trillions in cumulative transaction volume, is seeking a Senior Manager of Application Security to lead security across its extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and smart contracts.
This is a hands-on leadership role reporting to the Head of Security. You will set application security strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modeling.
**Key Responsibilities:**
**Leadership & Planning:** Lead and develop the Application Security team including hiring, performance management, and career development. Set AppSec strategy, annual goals, and quarterly OKRs aligned with company objectives. Report progress, coverage, remediation performance, and material gaps to Security leadership and Risk Committee.
**Secure Design & Delivery:** Define security review requirements across development and release; assess compliance and escalate unresolved risks. Lead threat modeling and security design reviews across clients, APIs, and backend services, including authentication, key management, signing, and delegated actions. Define software supply chain security requirements for dependencies, builds, artifacts, and publishing. Lead security code reviews across MetaMask applications and smart contracts. Define and evolve secure development lifecycle to incorporate AI agents, including access, actions, and human review requirements. Integrate security testing into workflows (static/dynamic analysis, dependency scanning, secrets detection, AI scanning). Help engineers prevent recurring vulnerabilities through secure coding guidance, reusable libraries, training, and security champions programs.
**Vulnerability Management & External Testing:** Own application vulnerability assessment, triage, prioritization, and remediation tracking. Correlate findings across clients, services, and infrastructure. Set scope and investment for bug bounty, penetration testing, and AI security scanning. Manage external providers, researcher relationships, rewards, and vulnerability disclosure.
**Assurance & Incident Support:** Provide evidence of application security controls for audits and assurance reviews. Support customer and partner due diligence. Provide AppSec expertise during incidents.
**Requirements:**
**Required:**
- At least 8 years in application security or software engineering with security focus, including 2 years leading people
- Strong practical code review skills in TypeScript/JavaScript, Go, or Solidity across browser extensions, mobile applications, and backend services; ability to identify vulnerabilities and work with engineers to fix them
- Proven experience securing applications across clients and backend services, including distributed authentication, authorization, and key management
- Experience building or substantially improving an AppSec program (security reviews, automated testing, AI scanning, vulnerability management, developer support) with sound judgment on AI value and validation
- Practical experience securing software supply chains (dependency policies, software composition analysis, npm, artifact integrity, CI/CD)
- Experience running bug bounty and penetration testing programs, including selecting and managing external providers
- Working knowledge of EVM smart contract security (common vulnerabilities, review methods, upgrade and admin controls, assessing external audits)
- Record of delivering security improvements through engineering teams outside reporting line
- Clear written communication from actionable threat models to concise executive risk summaries
**Preferred:**
- Offensive security qualifications (OSCP, OSWE, OSWA) or proven record in bug bounty or CTF competitions
- Experience securing browser extensions or mobile applications
- Experience securing development workflows using AI or AI components in production
- Experience in crypto, Web3, fintech, payments, or infrastructure sectors facing sustained attacks
- Knowledge of or strong interest in applied cryptography
- Familiarity with state-actor attacks against software companies (DPRK supply chain, social engineering)
- Experience providing evidence of secure development controls for SOC 2 or ISO 27001 assessments
