Security Engineer

Mysten Labs, the team behind Sui and Move, is hiring a hands-on Security Engineer with strong application security fundamentals and a record of finding and fixing real vulnerabilities. You will own bug bounty programs and external audits and protect Mysten's products and users across the Sui ecosystem.

Responsibilities

• Run bug bounty programs: triage, severity, escalation, fix validation, budget and payouts
• Own audit engagements from scoping to remediation and fix validation
• Conduct code and design reviews in Rust, TypeScript and Move, and run variant analysis
• Own software supply chain security, including dependency and CI/CD defenses
• Build anti-scam and anti-abuse tooling for the Sui ecosystem (phishing sites, malicious dApps, drainer contracts)
• Build security tooling, including LLM-driven triage agents and static and dynamic analysis in CI

What we are looking for

• 3+ years in security, application security or product security, with a track record of finding real vulnerabilities
• Strong web security fundamentals (XSS, CSRF, SSRF, authorization flaws, injection, supply chain failures)
• Proficiency in Rust, TypeScript, Python or Move
• Solid applied cryptography fundamentals
• Experience on either side of a bug bounty or audit engagement
• Interest in the web3 space is required
• Preferred: smart contract or wallet security, program analysis, anti-phishing experience

Additional Information

Remote within the USA. The employer lists a salary range of $140,000 – $190,000.