Senior Manager, Application Security

🔥 1 hour ago

🇪🇺 Europe – Remote

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

MetaMask

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2016

₿ Crypto

🌐 Web 3

💳 Fintech

Crypto • Web 3 • Fintech

MetaMask is a leading self-custodial crypto wallet that serves as a gateway to blockchain applications. Available as a browser extension and mobile app, it enables users to track and manage their web3 assets securely and conveniently. With features such as buying, selling, staking, and bridging crypto tokens, MetaMask empowers over 100 million users worldwide to control their digital assets and interact on the decentralized web with privacy and security.

📋 Description

• Lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts • Set application security strategy, annual goals, quarterly OKRs, KPIs, and operating model • Lead and develop the Application Security team, including hiring, performance management, and career development • Report AppSec progress, coverage, remediation performance, and material gaps to Security leadership and contribute to Risk Committee reporting • Define security review requirements across development and release and escalate unresolved risks • Lead threat modelling and security design reviews across clients, APIs, and backend services • Define and validate software supply chain security controls for dependencies, builds, artefacts, and publishing • Lead security code reviews across MetaMask applications and smart contracts • Evolve secure development lifecycle controls for AI agents, AI development tools, generated code, and AI product components • Integrate and validate static and dynamic analysis, dependency scanning, secrets detection, and AI scanning • Support secure coding guidance, reusable libraries, training, and the security champions programme • Own vulnerability assessment, triage, prioritisation, remediation tracking, fix verification, and escalation • Manage bug bounty, penetration testing, AI security scanning, external providers, researcher relationships, rewards, payouts, and vulnerability disclosure • Provide application security evidence for audits and assurance reviews and support customer and partner due diligence • Provide application security expertise during incidents, including vulnerability analysis and remediation support • Report to the Head of Security and work closely with MetaMask Engineering leadership

🎯 Requirements

• At least eight years in application security or software engineering with a security focus, including two years leading people • Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services • Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management • Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support • Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD • Experience running bug bounty and penetration testing programmes, including selecting and managing external providers • Working knowledge of EVM smart contract security • Record of delivering security improvements through engineering teams outside the reporting line • Clear written communication • Preferred: OSCP, OSWE or OSWA; browser extension or mobile application security; AI security; crypto/Web3 or similarly attacked sectors; applied cryptography; state-actor attack knowledge; SOC 2 or ISO 27001 evidence experience • Applicants may be required to submit to background and identity verification checks • Applications cannot be considered from candidates based in France, Italy, or Germany

🏖️ Benefits

• Remote-first, global team environment • Equal opportunity employer • Background and identity verification checks as required • Human review of AI-assisted recruitment decisions