Senior Security Engineer

Mysten Labs

6d•$165,000 - $225,000•Remote

About The Position

Mysten Labs is hiring a Senior Security Engineer to advance security across its foundational infrastructure and products, including the Sui and Move technology stack. The role builds and operates security platforms and services, protects endpoints and cloud environments, and supports the development of secure systems for on-chain finance and the emerging agent economy. The team is remote-first and hiring across the world. The engineer will operate a large-scale security observability and data platform, own endpoint security, lead threat hunting and incident response, and build production security services. The role also includes developing an agent platform that uses LLM agents to automate security workflows with deterministic checks where needed, reviewing infrastructure and cloud designs, conducting adversary-emulation exercises, and documenting incidents and operational procedures.

Requirements

Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
At least 5 years of experience in security engineering, detection and response, or infrastructure/SRE with a security focus, including hands-on incident response on endpoints and in the cloud.
Experience operating an EDR and writing and tuning detections.
Knowledge of macOS and Linux internals as used by attackers, including persistence, credential theft, process injection, and living-off-the-land binaries.
Experience building or operating telemetry pipelines and a SIEM or security data lake at terabyte scale.
Strong SQL skills, including writing detection logic over large datasets.
Hands-on production engineering experience with Linux, containers, Kubernetes, at least one major public cloud, infrastructure as code, monitoring, and alerting.
Proficiency in Python or Go, and comfort with Rust or willingness to work in it.
Working knowledge of identity, including SSO (OIDC/SAML), phishing-resistant MFA, device trust, and session and token theft.
Strong written communication skills, including the ability to run an incident channel and write post-mortems.
Interest in the web3 space.

Nice To Haves

Experience building zero-trust access, identity-aware proxies, or policy engines.
Experience with binary authorization or allowlisting at fleet scale.
Familiarity with threat actors targeting crypto companies and their methods, including social engineering, fake campaigns, and supply chain compromises.
Digital forensics experience, including memory, disk, and macOS unified logs, and malware analysis.
Experience building security tooling with LLM agents, such as Claude Code skills or comparable tools, and understanding where models help versus where deterministic tooling is needed.
Experience with compliance as code, including CIS benchmarks, and experience in ISO 27001 or SOC 2 environments.
Publications, conference talks, or open-source security tooling.

Responsibilities

Build and operate the Security Observability & Data Platform, including ingestion, normalization, retention, querying, and detection across tens of terabytes of data per month.
Develop, test, review, and measure the precision of security detections.
Own endpoint security across the fleet by deploying and tuning EDR, responding to endpoint threats, operating binary authorization, and establishing hardening baselines with IT Operations.
Lead threat hunting, internal investigations, and insider-threat work.
Handle security incidents end to end, including triage, containment, forensics, root cause analysis, and implementing controls to prevent recurrence.
Build and operate production security services, including zero-trust authentication and authorization, a uniform blocking service, an application proxy, asset inventory, a developer portal, and compliance as code.
Build and operate the agent platform locally and on Kubernetes, using LLM agents to automate triage, enrichment, investigation, and response, with deterministic checks where needed.
Review Kubernetes, AWS/GCP, bare-metal, and CI-runner infrastructure and cloud designs for security, and help engineering teams adopt shared services.
Run red-team and adversary-emulation exercises and translate findings into detections and fixes.
Write runbooks and post-mortems that can be followed by people who were not present during an incident.