Blockchain Security Researcher

As a Blockchain Security Researcher at OpenZeppelin, you join the Security Services team responsible for protecting the world's leading web3 protocols and top financial institutions building onchain. You conduct smart contract audits for top decentralized applications, blockchain infrastructure, and financial institutions, working across the full protocol lifecycle from design through production evolution.

What you'll do

• Review smart contracts for top decentralized applications, blockchain infrastructure, and financial institutions before they launch, identify vulnerabilities, prioritize them, and present findings to clients.
• Drive audits independently from start to finish, using AI as your primary collaborator and partnering with other researchers when useful to pressure-test findings.
• Partner with client teams during the design phase of new protocols, analyzing architecture, trust assumptions, and operational constraints before any code is written through Design Reviews and Applied Research engagements.
• Use AI efficiently throughout the audit process and build skills, agents, and workflows that compound across the team.
• Conduct open-ended research into cutting-edge blockchain technologies, vulnerability classes, and emerging attack vectors, and contribute findings back to OpenZeppelin's internal knowledge base and the broader ecosystem.

What you bring

• Hands-on and practical experience in one or more of the following: software development, cybersecurity, applied mathematics, distributed systems, cryptography, cryptoeconomics, game theory, or DeFi mechanisms.
• Experience designing and developing smart contracts, not only auditing them.
• Strong working knowledge of Solidity and the broader Ethereum and EVM ecosystem, including common libraries, frameworks, and smart contract patterns.
• Modern AI tooling is central to how you work, not a novelty. You use it daily to expand audit coverage, reason about complex systems, and produce high-quality outputs faster, and you evaluate AI-generated code with a critical eye.
• Comfort building and extending your own tooling, such as skills, agents, prompts, scripts, or full workflows, that the rest of the team can adopt and build on.
• Advanced English proficiency and strong communication skills, both oral and written.

Nice to have

• Experience with non-EVM ecosystems and languages, such as Canton, Move (Sui, Aptos), Golang (Cosmos SDK), Cairo (Starknet), Rust-based blockchains (Solana, Stellar), or ZK circuits and cryptography-heavy systems.
• Experience with risk assessment work in the crypto industry, such as smart contract risk assessment and threat modeling.
• Working hand-in-hand with protocol teams on co-creative engagements, helping design, specify, and implement smart contracts alongside research.
• Web2 security expertise in penetration testing, web application security, infrastructure security, or appsec.
• Experience with formal verification, invariant testing, or advanced fuzzing tools such as Echidna, Foundry, Halmos, or Certora.
• A track record in audit contests (Code4rena, Sherlock, Cantina) or bug bounty platforms (Immunefi, HackerOne).
• Public security research output, such as published findings, blog posts, conference talks, or contributions to open-source security tooling.

What we offer

• Fully remote work with the flexibility to meet teammates at company gatherings around the world.
• Flexible time off.
• 8 weeks of paid leave for primary caregivers, 4 weeks for secondary caregivers, and a one-time $3,600 baby bonus.
• Up to $500 in home office equipment support.
• Medical insurance.
• Learning and development opportunities.
• A monthly stipend for your preferred co-working space.

About OpenZeppelin

OpenZeppelin is the security standard onchain finance is built on. Founded in 2015, the company combines AI-native security tooling with deep research and a decade of audit expertise to support leading institutions and crypto-native teams across the full secure development lifecycle. OpenZeppelin's open-source Contract Libraries have facilitated over $35 trillion in onchain value and are used by 10 of the top 10 tokenized money market funds and 9 of the top 10 stablecoins by market cap.