OpenZeppelin's Security Services team is seeking a Blockchain Security Researcher to review smart contracts for leading decentralized applications, blockchain infrastructure, and financial institutions. You will conduct audits independently, partner with client teams during protocol design phases, and conduct open-ended research into emerging blockchain vulnerabilities and attack vectors.
What you'll do
- Review smart contracts for top decentralized applications, blockchain infrastructure, and financial institutions before launch, identify vulnerabilities, prioritize findings, and present results to clients
- Drive audits independently from start to finish, using AI as your primary collaborator and partnering with other researchers when useful to pressure-test findings
- Partner with client teams during the design phase of new protocols, analyzing architecture, trust assumptions, and operational constraints before code is written
- Design and help develop smart contracts as part of co-creative engagements with protocol teams, where research, design, specification, and implementation happen together
- Use AI efficiently throughout the audit process and build skills, agents, and workflows that compound across the team
- Conduct open-ended research into cutting-edge blockchain technologies, vulnerability classes, and emerging attack vectors, and contribute findings to OpenZeppelin's internal knowledge base and the broader ecosystem
What you bring
- Hands-on experience in software development, cybersecurity, applied mathematics, distributed systems, cryptography, cryptoeconomics, game theory, or DeFi mechanisms
- Experience designing and developing smart contracts, not only auditing them
- Strong working knowledge of Solidity and the broader Ethereum and EVM ecosystem, including common libraries, frameworks, and smart contract patterns
- Daily use of modern AI tooling to expand audit coverage, reason about complex systems, and produce high-quality outputs faster, with the ability to evaluate AI-generated code critically
- Comfort building and extending your own tooling such as skills, agents, prompts, scripts, or full workflows that the rest of the team can adopt and build on
- Advanced English proficiency and strong communication skills, both oral and written
Nice to have
- Experience with non-EVM ecosystems and languages, such as Canton, Move (Sui, Aptos), Golang (Cosmos SDK), Cairo (Starknet), or Rust-based blockchains (Solana, Stellar)
- Experience with ZK circuits and cryptography-heavy systems
- Risk assessment work in the crypto industry, including smart contract risk assessment and threat modeling
- Web2 security expertise in penetration testing, web application security, infrastructure security, or application security
- Experience with formal verification, invariant testing, or advanced fuzzing tools such as Echidna, Foundry, Halmos, or Certora
- Track record in audit contests (Code4rena, Sherlock, Cantina) or bug bounty platforms (Immunefi, HackerOne)
- Public security research output, such as published findings, blog posts, conference talks, or contributions to open-source security tooling
What we offer
- Fully remote work
- Flexible time off and paid parental leave
- Company in-person gatherings in different locations around the world
- One-time work-from-home equipment stipend of up to $500 USD
- Medical insurance coverage
- Learning and Development opportunities
About OpenZeppelin
OpenZeppelin is the security standard for on-chain finance, founded in 2015 to accelerate the transition to an open financial system. Their open-source Contract Libraries have facilitated over $35 trillion in on-chain value and are used by leading institutions including DTCC, Fidelity, Coinbase, Uniswap, Aave, and the Ethereum Foundation across the full secure development lifecycle.