Security Engineer

Mysten Labs

20d • $140,000 - $190,000 • Remote

About The Position

Mysten Labs is seeking a hands-on Security Engineer with strong application security fundamentals and a record of finding and fixing real vulnerabilities. The role owns bug bounty programs and external audits, secures code and the software supply chain, and builds tooling to protect Mysten’s products and users across the Sui ecosystem.

The Security Engineer works across systems built by Mysten Labs, its subsidiaries, and partners, and collaborates with wallet teams and other stakeholders to investigate and remediate security issues. The position also builds automated analysis and anti-abuse capabilities, including LLM-assisted security tooling and static and dynamic analysis integrated into CI and code review.

Mysten Labs describes its team as remote first and says it is hiring across the world.

Requirements

• Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
• At least 3 years of hands-on experience in security engineering, application security, or product security, with a record of finding real vulnerabilities through bug bounty reports, audit findings, CVEs, or published research.
• Strong Web2 security fundamentals, including XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, and cryptographic failures.
• Proficiency in one or more of Rust, TypeScript, Python, or Move, and experience reviewing and writing security-sensitive code.
• Hands-on knowledge of software supply chain attack surfaces, including package ecosystems such as npm, crates.io, and PyPI; CI/CD risks such as GitHub Actions workflow injection, token exposure, and unpinned actions; and build provenance.
• Solid understanding of applied cryptography fundamentals and common ways cryptographic systems are misused.
• Experience on either side of a bug bounty program or an audit engagement.
• Strong written and verbal communication skills, including the ability to influence teams without formal authority.
• Interest in the web3 space.

Nice To Haves

• Smart contract or wallet security experience with Move, Solidity, or Rust-based chains; familiarity with Sui's object and capability model is a plus.
• Experience with static or dynamic program analysis, including CodeQL, Semgrep, taint analysis, fuzzing, or symbolic execution.
• Experience building security tooling with LLM agents, such as Claude Code skills or comparable tools, and an understanding of where models help and where deterministic tooling is necessary.
• Anti-phishing, anti-fraud, or trust and safety experience, including domain and content monitoring, crawling, classifiers, or threat intelligence.
• Knowledge of recent crypto incidents and their underlying defect classes, including drainer kits, DeFi frontend compromises, and package-registry compromises.
• Notable bug bounty rankings, CVEs, publications, or conference talks.

Responsibilities

• Run Mysten's bug bounty programs, including triage, severity assessment, responses, internal escalations, fix validation, budgeting, and payouts; turn recurring report classes into automated checks.
• Own external audit engagements by scoping and scheduling audits, serving as the technical counterpart, and tracking findings through remediation and fix validation.
• Conduct code and design reviews of systems built by Mysten, its subsidiaries, and partners, including Rust, TypeScript, and Move systems.
• Drive security issues through investigation, incident response, and resolution, and perform variant analysis to address each vulnerability class wherever it occurs.
• Own software supply chain security, including dependency and CI/CD malware defenses, Endor Labs, GitHub controls, merge bots, and the ongoing code security self-auditing service.
• Detect and respond to compromised packages, maintainers, and build pipelines; secure the provenance and signing of shipped software.
• Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem to detect phishing sites, malicious dApps, drainer contracts, and other threats targeting users; work with wallet teams on mitigations.
• Build security tooling, including LLM-driven triage and review agents and static and dynamic analysis such as taint analysis, call graphs, and fuzzing, integrated into CI and code review.
• Build known-clean checks so users can trust security tooling results.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level