Security Engineer
Mysten Labs develops blockchain infrastructure and protocols including Sui network, Walrus storage, and Enoki platform for decentralized applications.
Projects
About Mysten Labs
Mysten Labs builds critical infrastructure enabling decentralized internet adoption through blockchain technology. The company develops protocols and tools including the Sui Layer 1 blockchain, Walrus decentralized storage network, and Enoki developer platform. Founded by former Meta executives who led the Diem blockchain and Move programming language development, Mysten Labs applies distributed systems expertise and cryptographic research to create scalable Web3 infrastructure.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will run bug bounty programs and external audits, review code and designs, and remediate vulnerabilities. You will secure the software supply chain, build anti-scam and security tooling, investigate incidents, and integrate static and dynamic security analysis into development workflows.
Requirements
- 3+ years of security engineering, application security, or product security experience
- Application-security experience finding real vulnerabilities
- Knowledge of XSS, CSRF, SSRF, authorization flaws, injection, deserialization, supply-chain failures, and cryptographic failures
- Proficiency in Rust, TypeScript, Python, or Move
- Experience reviewing and writing security-sensitive code
- Knowledge of npm, crates.io, PyPI, CI/CD security, and build provenance
- Applied cryptography knowledge
- Experience with bug bounty programs or audit engagements
- Written and verbal communication skills
- Interest in web3
Responsibilities
- Run bug bounty programs, including triage, severity assessment, responses, escalations, fix validation, budgets, and payouts
- Own external audit engagements and track findings through remediation
- Conduct code and design reviews and drive security issues to conclusion
- Investigate incidents and perform variant analysis
- Secure software supply chains, dependencies, CI/CD pipelines, provenance, and signing
- Detect and respond to compromised packages, maintainers, and build pipelines
- Build anti-scam and anti-abuse tooling for the Sui ecosystem
- Build LLM-driven triage and review agents and static and dynamic analysis tooling
Benefits
- Token and equity compensation
- Annual equity and token refresh grant eligibility
- Medical, dental, and vision insurance for employees and dependents
- HSA and FSA benefits
- 18 weeks of paid parental leave
- Wellbeing, family-planning, gender-affirming-care, fitness, nutrition, mental-health, counseling, and EAP programs
- Short- and long-term disability coverage
- Life and accident insurance
- Traveler insurance
- 401(k)
- Privacy protection service
- Wellness stipend
- Flexible paid time off
- 11 paid holidays per year
- Team offsites and annual company retreat