Remote opportunity at
ConsensysSenior Manager, Application Security
Consensys seeks a Senior Manager, Application Security to direct application security initiatives across the MetaMask extension, mobile application, Snaps, backend services, DeFi primitives, stablecoins, and associated…
Career Tools
About This Role
Consensys seeks a Senior Manager, Application Security to direct application security initiatives across the MetaMask extension, mobile application, Snaps, backend services, DeFi primitives, stablecoins, and associated smart contracts. Operating in a hands-on leadership capacity, this person will define strategy, manage a compact team of senior professionals, and maintain direct involvement in code reviews and threat modeling. Reporting directly to the Head of Security, the role involves close collaboration with MetaMask…
Job Description
Consensys seeks a Senior Manager, Application Security to direct application security initiatives across the MetaMask extension, mobile application, Snaps, backend services, DeFi primitives, stablecoins, and associated smart contracts. Operating in a hands-on leadership capacity, this person will define strategy, manage a compact team of senior professionals, and maintain direct involvement in code reviews and threat modeling. Reporting directly to the Head of Security, the role involves close collaboration with MetaMask Engineering leadership to ensure security risks are properly understood, owned, and mitigated.
The position requires establishing application security strategy, annual goals, and quarterly OKRs aligned with broader company targets, as well as tracking key performance indicators. Responsibilities encompass defining security review protocols, directing threat modeling, analyzing trust boundaries, and implementing software supply chain security requirements. The successful candidate will oversee vulnerability management, drive security code reviews, integrate automated testing into delivery workflows, manage external bug bounty and penetration testing programs, and provide expertise during security incidents.
Consensys is a remote-first organization operating globally. Please note that applications cannot be accepted from candidates located in France, Italy, or Germany for this position.
Responsibilities
- Lead, hire, and develop the Application Security team while participating directly in technical tasks.
- Establish the Application Security strategy, annual goals, quarterly OKRs, and performance KPIs.
- Define security review requirements for development and release cycles and evaluate compliance.
- Lead threat modeling and security design reviews across clients, APIs, and backend services.
- Define and implement software supply chain security controls for dependencies, builds, artifacts, and publishing.
- Conduct security code reviews across MetaMask applications and smart contracts.
- Evolve the secure development lifecycle to incorporate AI agents, access controls, and generated code standards.
- Integrate security testing tools including static analysis, dynamic analysis, and dependency scanning into workflows.
- Manage application vulnerability assessment, triage, prioritization, and remediation tracking.
- Oversee external bug bounty and penetration testing programs, vendor relationships, and researcher payouts.
Requirements
- At least eight years of professional experience in application security or software engineering with a security focus
- Minimum of two years of experience leading people
- Strong code review proficiency in TypeScript, JavaScript, Go, or Solidity across browser extensions, mobile applications, and backend services
- Experience securing distributed authentication, authorization, and key management across clients and backend services
- Track record of building or significantly enhancing an application security program
- Practical experience managing software supply chain security including dependency policies, software composition analysis, npm, and CI/CD
- Experience operating bug bounty and penetration testing programs including provider selection and management
- Working knowledge of EVM smart contract security, vulnerabilities, review methods, and upgrade controls
- Proven ability to drive security improvements through engineering teams outside direct reporting lines
- Clear written communication skills for producing threat models and executive risk summaries
Qualifications
- Offensive security certifications such as OSCP, OSWE, or OSWA, or a history of success in bug bounty programs or CTF competitions
- Experience securing browser extensions or mobile applications
- Experience securing development workflows utilizing AI or production applications containing AI components
- Background in crypto, Web3, fintech, payments, or infrastructure sectors facing sustained attack
- Knowledge of or strong interest in applied cryptography
- Familiarity with state actor threats, particularly DPRK supply chain campaigns and social engineering
- Experience providing evidence of secure development controls for SOC 2 or ISO 27001 assessments
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the remote work policy for this position?
The role is part of a remote-first, global team. However, the posting notes that applications cannot be considered from candidates based in France, Italy, or Germany.
What are the primary experience requirements?
Candidates must have at least eight years in application security or software engineering with a security focus, including a minimum of two years leading people.
What is the salary for this role?
The salary is not stated in the job posting.
Who will this position report to?
This role reports to the Head of Security.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.