Senior Security Engineer

As a Senior Security Engineer at Mysten Labs, you build and operate critical security infrastructure for a web3 organization advancing the internet through foundational blockchain and AI technology. You own detection, response, identity, and cloud security across the company's infrastructure, combining hands-on incident response with platform engineering to protect Sui, Move, and our broader technology stack.

What you'll do

• Build and operate the Security Observability & Data Platform handling tens of TB per month and growing, including ingestion, normalization, retention, and a query and detection layer where detections are code that is tested, reviewed, and measured for precision.
• Own endpoint security across the fleet: deploy and tune EDR, run and configure binary authorization, and set hardening baselines with IT Operations.
• Lead threat hunting, internal investigations, and insider-threat work. Handle security incidents end to end, from triage and containment through forensics, root cause analysis, and implementing controls to prevent recurrence.
• Build next-generation security services and run them in production: zero-trust authentication and authorization, a uniform blocking service, an application proxy, asset inventory, developer portal, and compliance as code.
• Build and run the agent platform on local and Kubernetes environments, using LLM agents to automate triage, enrichment, investigation, and response with deterministic checks where a model's answer is insufficient.
• Review infrastructure and cloud designs spanning Kubernetes, AWS, GCP, bare metal, and CI runners for security, and help engineering teams adopt shared services instead of building their own.
• Run red-team and adversary-emulation exercises, and turn results into detections and fixes.
• Write runbooks and post-mortems clear enough for someone unfamiliar with the incident to follow at 3 a.m.

What you bring

• A Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
• 5+ years in security engineering, detection and response, or infrastructure/SRE with a security focus, including hands-on incident response on endpoints and in the cloud.
• Experience operating an EDR and writing and tuning detections. Knowledge of macOS and Linux internals as attackers use them: persistence, credential theft, process injection, living-off-the-land binaries.
• Experience building or operating telemetry pipelines and a SIEM or security data lake at TB scale. Strong SQL, including detection logic over large datasets.
• Hands-on production engineering: Linux, containers, Kubernetes, at least one major public cloud, infrastructure as code, monitoring and alerting.
• Proficiency in Python or Go, and comfort with Rust or willingness to work in it (most of Mysten's stack is Rust).
• Working knowledge of identity: SSO (OIDC/SAML), phishing-resistant MFA, device trust, and how session and token theft work.
• Strong written communication: you can run an incident channel and write the post-mortem.
• Interest in the web3 space.

Nice to have

• Experience building zero-trust access, identity-aware proxies, or policy engines.
• Binary authorization or allowlisting at fleet scale.
• Familiarity with threat actors that target crypto companies and their methods, from social engineering and fake campaigns to supply chain compromises.
• Digital forensics (memory, disk, macOS unified logs) and malware analysis.
• Experience building security tooling with LLM agents (Claude Code skills or comparable), with a clear sense of where models help and where deterministic tooling must do the work.
• Compliance as code (CIS benchmarks); experience in ISO 27001 or SOC 2 environments.
• Publications, conference talks, or open-source security tooling.

About Mysten Labs

Mysten Labs advances the internet through step-function improvements in foundational infrastructure and products. The company builds Sui, Move, and a broader technology stack spanning on-chain finance and the emerging agent economy, backed by a $300M Series B from leading venture funds including Jump Crypto, Andreessen Horowitz, Binance Labs, Redpoint, and others. The team is remote-first and hiring globally.