Security Engineer

🔥 14 hours ago

🌐 United States, Canada – Remote

🇺🇸 United States – Remote 🇨🇦 Canada – Remote

💵 $140k - $190k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 1%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Mysten Labs

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2021

🌐 Web 3

🎮 Gaming

₿ Crypto

💰 Series B on 2022-09

Web 3 • Gaming • Crypto

Mysten Labs is a company focused on building critical infrastructure to enable a more decentralized internet. They are developing next-generation platforms and protocols like Sui, a Web3 platform with the ease of Web2, and other innovations such as decentralized storage and data availability protocols. Mysten Labs also offers products catering to builders and web3 enthusiasts, including decentralized commerce systems and interactive gaming devices. Their research and development efforts include cryptography and novel programming languages. The company's goal is to reshape the future of the internet and expand the possibilities of Web3 with user-friendly solutions.

📋 Description

• Run Mysten's bug bounty programs, including triage, severity assessment, responses, internal escalations, fix validation, budget, and payouts • Turn recurring bug bounty report classes into automated checks • Own audit engagements by scoping and scheduling external audits, serving as technical counterpart, and tracking findings through remediation and fix validation • Conduct code and design reviews of systems built by Mysten, subsidiaries, and partners using Rust, TypeScript, and Move • Drive security issues to conclusion, including investigation and incident response • Run variant analysis to close each bug class wherever it occurs • Own software supply chain security, including dependency and CI/CD malware defenses, Endor Labs, GitHub controls, merge bots, and code security self-auditing • Detect and respond to compromised packages, maintainers, and build pipelines • Secure provenance and signing of shipped software • Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem • Detect phishing sites, malicious dApps, drainer contracts, and other threats targeting Sui users • Work with wallet teams on mitigations • Build security tooling including LLM-driven triage and review agents, static and dynamic analysis, taint analysis, call graphs, and fuzzing integrated into CI and code review • Build known-clean checks to improve trust in security tooling

🎯 Requirements

• Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience • 3+ years of hands-on experience in security engineering, application security, or product security • Track record of finding real vulnerabilities, such as bug bounty reports, audit findings, CVEs, or published research • Strong Web2 security fundamentals, including XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, and cryptographic failures • Proficiency in one or more of Rust, TypeScript, Python, or Move • Experience reviewing and writing security-sensitive code • Hands-on knowledge of software supply chain attack surfaces, including npm, crates.io, PyPI, GitHub Actions workflow injection, token exposure, unpinned actions, and build provenance • Solid understanding of applied cryptography fundamentals and common cryptographic misuse • Experience on either side of a bug bounty program or audit engagement • Strong written and verbal communication and ability to influence teams without formal authority • Interest in the web3 space is required • Employment contingent upon successful background check, potentially including employment history, education credentials, and criminal history verification

🏖️ Benefits

• Tokens + equity compensation • Benefits • Eligibility to participate in annual equity and token refresh grant programs • Comprehensive health insurance including medical, dental, and vision for employees and dependents • Tax savings benefits including HSAs and FSAs • 18 weeks of paid parental leave • Wellbeing programs, including family planning support, gender affirming care, hormone replacement therapy, and physical fitness/nutrition apps • Mental health support and counseling • Employee Assistance Program for financial/legal assistance and home life referrals • Short-term and long-term disability coverage • Life insurance and accident insurance • Traveler insurance • 401(k) • Complimentary privacy protection service • Wellness stipend • Flexible paid time off • 11 paid holidays per year • Team offsites and annual all-company retreat