SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Mysten Labs is building foundational infrastructure for web3, spanning on-chain finance and the emerging agent economy through Sui, Move, and related technologies. This Senior Security Engineer role is a broad, hands-on position spanning detection, response, infrastructure security, and emerging security automation.
Key responsibilities include:
- Build and operate the Security Observability & Data Platform (tens of TB/month and growing), covering ingestion, normalization, retention, and the query and detection layer. Detections are code: tested, reviewed, and measured for precision.
- Own endpoint security across the fleet: deploy and tune EDR, run binary authorization, and set hardening baselines with IT Operations.
- Lead threat hunting, internal investigations, and insider-threat work. Handle security incidents end-to-end: triage, containment, forensics, root cause analysis, and preventive controls.
- Build next-generation security services and run them in production: zero-trust AuthN/AuthZ, uniform blocking service, application proxy, asset inventory, developer portal, and compliance as code.
- Build and run the agent platform (local and Kubernetes), using LLM agents to automate triage, enrichment, investigation, and response, with deterministic checks where model answers are insufficient.
- Review infrastructure and cloud designs (Kubernetes, AWS/GCP, bare metal, CI runners) for security and help engineering teams adopt shared services.
- Run red-team and adversary-emulation exercises, turning results into detections and fixes.
- Write runbooks and post-mortems that enable incident response at any time.
Minimum Qualifications:
- Bachelor's degree in Computer Science, Computer Engineering, relevant technical field, or equivalent practical experience.
- 5+ years in security engineering, detection and response, or infrastructure/SRE with security focus, including hands-on incident response on endpoints and in the cloud.
- Experience operating an EDR, writing and tuning detections. Knowledge of macOS and Linux internals as attackers use them: persistence, credential theft, process injection, living-off-the-land binaries.
- Experience building or operating telemetry pipelines and a SIEM or security data lake at TB scale. Strong SQL, including detection logic over large datasets.
- Hands-on production engineering: Linux, containers, Kubernetes, at least one major public cloud, infrastructure as code, monitoring and alerting.
- Proficiency in Python or Go, and comfort with Rust or willingness to work in it (most of Mysten's stack is Rust).
- Working knowledge of identity: SSO (OIDC/SAML), phishing-resistant MFA, device trust, and how session and token theft work.
- Strong written communication: can run an incident channel and write post-mortems.
- Interest in the web3 space is required.
Preferred Qualifications:
- Experience building zero-trust access, identity-aware proxies, or policy engines.
- Binary authorization or allowlisting at fleet scale.
- Familiarity with threat actors targeting crypto companies and their methods, from social engineering and fake campaigns to supply chain compromises.
- Digital forensics (memory, disk, macOS unified logs) and malware analysis.
- Experience building security tooling with LLM agents (Claude Code skills or comparable), with clear sense of where models help and where deterministic tooling is required.
- Compliance as code (CIS benchmarks); experience in ISO 27001 or SOC 2 environments.
- Publications, conference talks, or open-source security tooling.
