Security Engineer

As a Security Engineer at Mysten Labs, you own bug bounty programs, external audits, code and design reviews, and software supply chain security across Sui, Move, and the broader Mysten technology stack. You build tooling to detect and prevent phishing, malicious dApps, drainer contracts, and other threats targeting Sui users and the ecosystem.

What you'll do

• Run Mysten's bug bounty programs: triage and assign severity to submissions, manage responses and internal escalations, validate fixes, manage budget and payouts, and turn recurring report classes into automated checks.
• Own audit engagements: scope and schedule external audits, serve as the technical counterpart during reviews, and track findings through remediation and fix validation.
• Conduct code and design reviews of systems built by Mysten, its subsidiaries, and partners in Rust, TypeScript, and Move, drive issues to resolution including investigation and incident response, and run variant analysis to close each bug class everywhere it occurs.
• Own software supply chain security: manage dependency and CI/CD malware defenses, Endor Labs, code security controls (GitHub settings, merge bots), and the ongoing code security self-audit service; detect and respond to compromised packages, maintainers, and build pipelines; and secure the provenance and signing of Mysten releases.
• Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts, and other threats targeting Sui users, and work with wallet teams on mitigations.
• Build security tooling including LLM-driven triage and review agents, static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review, with built-in known-clean checks so teams trust the results.

What you bring

• A Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
• 3+ years of hands-on experience in security engineering, application security, or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs, or published research).
• Strong Web2 security fundamentals: understanding of XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, and cryptographic failures.
• Proficiency in one or more of Rust, TypeScript, Python, or Move, with experience reviewing and writing security-sensitive code.
• Hands-on knowledge of software supply chain attack surface: package ecosystems (npm, crates.io, PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance.
• Solid understanding of applied cryptography fundamentals and common ways cryptographic systems are misused in practice.
• Experience on either side of a bug bounty program or an audit engagement.
• Strong written and verbal communication, including the ability to influence teams you have no formal authority over.
• Interest in the web3 space.

Nice to have

• Smart contract or wallet security expertise: Move, Solidity, or Rust-based chains; familiarity with Sui's object and capability model is a plus.
• Experience with static or dynamic program analysis tools: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution.
• Experience building security tooling with LLM agents (Claude Code or comparable), with a clear sense of where models help and where deterministic tooling is needed.
• Anti-phishing, anti-fraud, or trust and safety experience: domain and content monitoring, crawling, classifiers, threat intelligence.
• Knowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises.
• Notable bug bounty rankings, CVEs, publications, or conference talks.

About Mysten Labs

Mysten Labs builds foundational infrastructure and products spanning on-chain finance and the emerging agent economy. The company develops Sui, Move, and a broader technology stack that enables secure, scalable blockchain infrastructure and new ways for businesses and AI agents to interact. Mysten Labs raised a $300M Series B from top venture firms including Jump Crypto, Andreessen Horowitz, Binance Labs, Redpoint, Lightspeed, and others, and operates as a remote-first team hiring globally.