Security Engineer

As a Security Engineer at Mysten Labs, you own bug bounty programs and external audits, secure code and software supply chain, and build tooling that protects Mysten's products and users across the Sui ecosystem. You'll work across foundational infrastructure and products spanning on-chain finance and the emerging agent economy, with exposure to Sui, Move, and the broader technology stack.

What you'll do

• Run Mysten's bug bounty programs: triage, assess severity, respond to reports, handle internal escalations, validate fixes, and manage budget and payouts. Turn recurring report patterns into automated checks.
• Own audit engagements: scope and schedule external audits, act as the technical counterpart during reviews, and track findings through remediation and fix validation.
• Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners in Rust, TypeScript, and Move. Drive issues to resolution, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs.
• Own software supply chain security: defend against dependency and CI/CD malware, manage Endor Labs and the code security service, including GitHub controls and merge bots. Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of Mysten's releases.
• Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations.
• Build security tooling including LLM-driven triage and review agents, and static and dynamic analysis such as taint tracking, call graphs, and fuzzing wired into CI and code review.

What you bring

• Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
• 3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities through bug bounty reports, audit findings, CVEs or published research.
• Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures.
• Proficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code.
• Hands-on knowledge of software supply chain attack surface: package ecosystems such as npm, crates.io and PyPI; CI/CD including GitHub Actions workflow injection, token exposure, and unpinned actions; and build provenance.
• Solid understanding of applied cryptography fundamentals and the common ways cryptographic systems are misused in practice.
• Experience on either side of a bug bounty program or an audit engagement.
• Strong written and verbal communication, including the ability to influence teams you have no formal authority over.
• Interest in the web3 space.

Nice to have

• Smart contract or wallet security experience: Move, Solidity or Rust-based chains; Sui's object and capability model is a plus.
• Static or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution.
• Experience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling is necessary.
• Anti-phishing, anti-fraud or trust and safety experience: domain and content monitoring, crawling, classifiers, threat intelligence.
• Knowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises.
• Notable bug bounty rankings, CVEs, publications or conference talks.

About Mysten Labs

Mysten Labs builds foundational infrastructure and products that give people, businesses, and developers new ways to interact, transact, and create value. The company raised a $300M Series B round from top venture funds including Jump Crypto, Andreessen Horowitz, Binance Labs, Redpoint, Lightspeed, and Coinbase Ventures. The team is remote first and hiring worldwide.