Senior Manager, Application Security
MetaMask is an active Consensys-developed self-custodial crypto wallet and onchain finance platform available through browser extensions and mobile apps.
Projects
About MetaMask
MetaMask provides self-custodial digital-asset management and access to decentralized applications. Its current platform includes wallet functionality, token swaps, trading, payments, earning, MetaMask Card, security features, Snaps, Agent Wallet, and developer tooling. MetaMask is a Consensys product and brand rather than an independently evidenced legal entity.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will lead application security across browser extensions, mobile applications, backend services, DeFi primitives, stablecoins, and smart contracts. You will set security strategy and operating practices, manage and develop a senior team, conduct code reviews and threat modelling, strengthen the secure development lifecycle, and oversee vulnerability management, external testing, assurance, and incident support.
Requirements
- At least eight years of application security or security-focused software engineering experience, including two years leading people
- Practical code review skills in TypeScript, JavaScript, Go, or Solidity
- Experience securing client and backend applications, including distributed authentication, authorisation, and key management
- Experience building or significantly improving an application security programme
- Experience with security reviews, automated testing, AI scanning, vulnerability management, and developer support
- Experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity, and CI/CD
- Experience running bug bounty and penetration testing programmes and managing external providers
- Working knowledge of EVM smart contract security
- Experience delivering security improvements through engineering teams outside the reporting line
- Clear written communication
- Offensive security qualifications, bug bounty, or CTF experience preferred
- Experience securing browser extensions or mobile applications preferred
- Experience securing AI-enabled development workflows or production AI components preferred
- Crypto, Web3, fintech, payments, or infrastructure security experience preferred
- Knowledge of or interest in applied cryptography preferred
- Familiarity with state-actor supply-chain and social-engineering attacks preferred
- Experience supporting SOC 2 or ISO 27001 assessments preferred
Responsibilities
- Lead and develop the Application Security team, including hiring, performance management, and career development
- Set the Application Security strategy, goals, OKRs, and KPIs
- Report application security progress, coverage, remediation performance, and material gaps to Security leadership
- Define and assess security review requirements across development and release
- Lead threat modelling and security design reviews across clients, APIs, and backend services
- Define software supply chain security requirements and validate controls for dependencies, builds, artefacts, and publishing
- Lead security code reviews across applications and smart contracts
- Evolve the secure development lifecycle for AI agents, generated code, and AI components
- Integrate and evaluate security testing tools and findings
- Provide secure coding guidance, reusable libraries, training, and a security champions programme
- Own vulnerability assessment, triage, prioritisation, remediation tracking, and risk escalation
- Manage bug bounty, penetration testing, AI security scanning, external providers, researcher relationships, rewards, and vulnerability disclosure
- Provide evidence for audits, assurance reviews, and due diligence
- Support incidents with vulnerability analysis and remediation expertise
Benefits
- Remote-friendly work environment
