Security Engineer

Join Mysten Labs, a company dedicated to advancing the internet through innovative technology. As a Security Engineer, you will play a crucial role in securing our code and software supply chain, managing bug bounty programs, and conducting audits. You will also build security tooling and improve anti-scam and anti-abuse measures for the Sui ecosystem. The ideal candidate will have a strong background in application security, experience with software supply chain security, and proficiency in programming languages such as Rust, TypeScript, Python, or Move.

• Run and manage Mysten's bug bounty programs, including triage, severity assessment, responses, internal escalations, fix validation, and budget management.
• Own audit engagements by scoping and scheduling external audits, acting as the technical counterpart during the engagement, and tracking findings through remediation.
• Conduct code and design reviews of systems built by Mysten, its subsidiaries, and partners, driving issues to conclusion and running variant analysis to ensure comprehensive bug class closure.

• Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures
• Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience
• Hands-on knowledge of software supply chain attack surface: package ecosystems (npm, , PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance
• Solid understanding of applied cryptography fundamentals and the common ways cryptographic systems are misused in practice
• Experience on either side of a bug bounty program or an audit engagement
• 3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs or published research)
• Proficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code
• Strong written and verbal communication, including the ability to influence teams you have no formal authority over
• Interest in the web3 space is required
• Smart contract or wallet security: Move, Solidity or Rust-based chains; Sui's object and capability model is a plus
• Static or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution
• Experience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling has to do the work
• Anti-phishing, anti-fraud or trust & safety experience: domain and content monitoring, crawling, classifiers, threat intelligence
• Knowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises
• Notable bug bounty rankings, CVEs, publications or conference talks