Security Engineer

You will run bug bounty programs and external audits, review code and designs, and remediate vulnerabilities. You will secure the software supply chain, build anti-scam and security tooling, investigate incidents, and integrate static and dynamic security analysis into development workflows.

Responsibilities

• Run bug bounty programs, including triage, severity assessment, responses, escalations, fix validation, budgets, and payouts
• Own external audit engagements and track findings through remediation
• Conduct code and design reviews and drive security issues to conclusion
• Investigate incidents and perform variant analysis
• Secure software supply chains, dependencies, CI/CD pipelines, provenance, and signing
• Detect and respond to compromised packages, maintainers, and build pipelines
• Build anti-scam and anti-abuse tooling for the Sui ecosystem
• Build LLM-driven triage and review agents and static and dynamic analysis tooling

Requirements

• 3+ years of security engineering, application security, or product security experience
• Application-security experience finding real vulnerabilities
• Knowledge of XSS, CSRF, SSRF, authorization flaws, injection, deserialization, supply-chain failures, and cryptographic failures
• Proficiency in Rust, TypeScript, Python, or Move
• Experience reviewing and writing security-sensitive code
• Knowledge of npm, crates.io, PyPI, CI/CD security, and build provenance
• Applied cryptography knowledge
• Experience with bug bounty programs or audit engagements
• Written and verbal communication skills
• Interest in web3

Benefits

• Token and equity compensation
• Annual equity and token refresh grant eligibility
• Medical, dental, and vision insurance for employees and dependents
• HSA and FSA benefits
• 18 weeks of paid parental leave
• Wellbeing, family-planning, gender-affirming-care, fitness, nutrition, mental-health, counseling, and EAP programs
• Short- and long-term disability coverage
• Life and accident insurance
• Traveler insurance
• 401(k)
• Privacy protection service
• Wellness stipend
• Flexible paid time off
• 11 paid holidays per year
• Team offsites and annual company retreat