Remote opportunity at
Mysten LabsSecurity Engineer
Mysten Labs is seeking a Security Engineer to join its remote-first team and build foundational infrastructure and products for the Sui ecosystem, on-chain finance, and the…
Career Tools
About This Role
Mysten Labs is seeking a Security Engineer to join its remote-first team and build foundational infrastructure and products for the Sui ecosystem, on-chain finance, and the agent economy. The employer creates systems that enable new ways for businesses, developers, and AI agents to interact and transact through technology like Sui and Move. This role suits a hands-on security professional who wants to protect products and users by managing bug bounty…
Job Description
Mysten Labs is seeking a Security Engineer to join its remote-first team and build foundational infrastructure and products for the Sui ecosystem, on-chain finance, and the agent economy. The employer creates systems that enable new ways for businesses, developers, and AI agents to interact and transact through technology like Sui and Move. This role suits a hands-on security professional who wants to protect products and users by managing bug bounty programs, overseeing external audits, and securing software supply chains.
The person in this position will take charge of vulnerability management, design security tooling, and collaborate with internal teams and partners to mitigate threats across codebases written in Rust, TypeScript, Python, and Move. The ideal candidate brings strong application security fundamentals, a history of discovering actual vulnerabilities, and an interest in the web3 space.
Responsibilities
- Manage bug bounty programs by handling triage, severity ratings, responses, internal escalations, fix validation, budgets, and payouts, while automating recurring report classes.
- Oversee external audits by scheduling engagements, serving as the technical contact, and tracking findings through remediation and validation.
- Perform code and design reviews for systems developed by the company, subsidiaries, and partners using Rust, TypeScript, and Move.
- Handle incident response, investigations, and variant analysis to ensure bug classes are completely closed.
- Secure the software supply chain by managing dependency defenses, CI/CD protections, GitHub controls, and code security self-auditing services.
- Detect and respond to compromised packages, maintainers, and build pipelines while securing the provenance and signing of shipped code.
- Develop anti-scam and anti-abuse tooling to identify phishing sites, malicious decentralized applications, and drainer contracts.
- Build custom security tooling, including static and dynamic analysis integrations and LLM-driven triage and review agents.
Requirements
- Minimum of three years of practical experience in application security, product security, or security engineering.
- Demonstrated track record of discovering real vulnerabilities through bug bounties, CVEs, audit findings, or published research.
- Solid understanding of Web2 security fundamentals such as XSS, CSRF, SSRF, injection, and authorization flaws.
- Proficiency in at least one of Rust, TypeScript, Python, or Move for reviewing and writing security-sensitive code.
- Practical knowledge of software supply chain attack surfaces, including package ecosystems and CI/CD environments.
- Familiarity with applied cryptography fundamentals and common misuse patterns.
- Experience participating on either side of bug bounty programs or audit engagements.
- Strong communication skills with the ability to influence teams without formal authority.
- Demonstrated interest in the web3 domain.
Qualifications
- Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
- Experience with smart contract or wallet security across Move, Solidity, or Rust-based chains, with Sui object and capability models being a plus.
- Familiarity with static or dynamic program analysis tools such as CodeQL, Semgrep, taint analysis, and fuzzing.
- Background in building security tooling using LLM agents.
- Experience in anti-phishing, anti-fraud, or trust and safety fields including domain monitoring and threat intelligence.
- Knowledge of recent crypto incidents, defect classes, and notable bug bounty rankings, CVEs, publications, or conference talks.
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the employer operates on a remote-first basis and hires globally.
What is the employment type?
The posting specifies full-time employment.
What is the salary for this role?
The job posting does not specify a salary.
What education or experience is required?
Candidates must have a bachelor's degree in a technical field or equivalent practical experience, along with 3 or more years of hands-on security engineering or application security experience.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.