Senior Application Security Engineer

As a Senior Application Security Engineer at RootstockLabs, you will help secure Bitcoin-backed DeFi infrastructure by reviewing code, smart contracts, and protocol changes, and by building the security automation that keeps the development lifecycle safe. You will work closely with development teams on threat modeling and architecture reviews, manage the bug bounty program end to end, and coordinate external security audits with third-party auditors.

What you'll do

• Perform security reviews of source code, smart contracts, and protocol changes across RootstockLabs projects
• Participate in design and architecture reviews and threat-model new products and features with development teams
• Triage and validate bug bounty reports, assess severity, and coordinate remediation with engineering
• Collaborate on external security audits: scope engagements and work with third-party auditors through to the resolution of findings
• Build and operate security automation, including AI-assisted code review, scanning, and findings-triage pipelines
• Research attack techniques relevant to the ecosystem (EVM, bridges, p2p) and translate findings into concrete defenses such as monitoring alerts, CI security checks, and hardening changes
• Support incident investigations when application-layer issues arise

What you bring

• 3+ years of experience in Application Security or Security Engineering
• A solid grasp of common vulnerability classes (OWASP Top 10) and secure code review in Java plus at least one of TypeScript/JavaScript, Python, Go, or Rust
• Hands-on experience with blockchain security: smart contract auditing (Solidity/EVM) or protocol/node-level security
• Experience building and operating security automation, AI-assisted workflows (LLM-based triage, code review, or scanning), SAST/DAST, dependency and secret scanning, and CI/CD security gates
• Fluent English

Nice to have

• Experience in bug bounty triage or vulnerability disclosure programs
• Experience mitigating network-level attacks (p2p, eclipse, DoS) or analyzing consensus-level attack scenarios
• Offensive security background (pentesting, red team, CTFs, exploit development)
• Public security research such as CVEs, bug bounty track record, audit reports, or conference talks
• Knowledge of C/C++ for node/client codebases
• Experience with fuzzing (smart contracts or native code)

What we offer

• Competitive compensation package and unique benefits designed to support your growth and well-being
• 100% remote work within a Central European to Argentinian time-zone window (UTC-3 to UTC+2, with about an hour's flexibility either side), and access to global coworking spaces
• Paid vacation and sick leave days
• Access to training programs, language courses, and learning sponsorship annually
• Opportunity to work with cutting-edge blockchain technology in a global, diverse team

About RootstockLabs

RootstockLabs is a key contributor to Rootstock, Bitcoin's financial infrastructure for lending, yield, and onchain capital markets. Rootstock is secured by 80%+ of Bitcoin's hash power and has run with 100% uptime since 2018. The platform hosts 200+ dApps, from DeFi protocols like Sushiswap and Oku to institutional names like Mercado Bitcoin, Animoca Brands, and Paystand.