Security Engineer designing controls for Kinaxis’s AI - powered supply - chain orchestration platform and corporate IT environments. Leading cloud security, vulnerability remediation, detection, and incident response.
About the role
- Security Engineer protecting Mysten Labs’ decentralized blockchain infrastructure and Sui ecosystem. Owning bug bounties, audits, supply-chain security, and anti-abuse tooling.
Responsibilities
- Run Mysten's bug bounty programs, including triage, severity assessment, responses, internal escalations, fix validation, budget, and payouts
- Turn recurring bug bounty report classes into automated checks
- Own audit engagements by scoping and scheduling external audits, serving as technical counterpart, and tracking findings through remediation and fix validation
- Conduct code and design reviews of systems built by Mysten, subsidiaries, and partners using Rust, TypeScript, and Move
- Drive security issues to conclusion, including investigation and incident response
- Run variant analysis to close each bug class wherever it occurs
- Own software supply chain security, including dependency and CI/CD malware defenses, Endor Labs, GitHub controls, merge bots, and code security self-auditing
- Detect and respond to compromised packages, maintainers, and build pipelines
- Secure provenance and signing of shipped software
- Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem
- Detect phishing sites, malicious dApps, drainer contracts, and other threats targeting Sui users
- Work with wallet teams on mitigations
- Build security tooling including LLM-driven triage and review agents, static and dynamic analysis, taint analysis, call graphs, and fuzzing integrated into CI and code review
- Build known-clean checks to improve trust in security tooling
Requirements
- Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience
- 3+ years of hands-on experience in security engineering, application security, or product security
- Track record of finding real vulnerabilities, such as bug bounty reports, audit findings, CVEs, or published research
- Strong Web2 security fundamentals, including XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, and cryptographic failures
- Proficiency in one or more of Rust, TypeScript, Python, or Move
- Experience reviewing and writing security-sensitive code
- Hands-on knowledge of software supply chain attack surfaces, including npm, crates.io, PyPI, GitHub Actions workflow injection, token exposure, unpinned actions, and build provenance
- Solid understanding of applied cryptography fundamentals and common cryptographic misuse
- Experience on either side of a bug bounty program or audit engagement
- Strong written and verbal communication and ability to influence teams without formal authority
- Interest in the web3 space is required
- Employment contingent upon successful background check, potentially including employment history, education credentials, and criminal history verification
Benefits
- Tokens + equity compensation
- Benefits
- Eligibility to participate in annual equity and token refresh grant programs
- Comprehensive health insurance including medical, dental, and vision for employees and dependents
- Tax savings benefits including HSAs and FSAs
- 18 weeks of paid parental leave
- Wellbeing programs, including family planning support, gender affirming care, hormone replacement therapy, and physical fitness/nutrition apps
- Mental health support and counseling
- Employee Assistance Program for financial/legal assistance and home life referrals
- Short-term and long-term disability coverage
- Life insurance and accident insurance
- Traveler insurance
- 401(k)
- Complimentary privacy protection service
- Wellness stipend
- Flexible paid time off
- 11 paid holidays per year
- Team offsites and annual all-company retreat
Job title
Job type
Experience level
Salary
Degree requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Adjunct faculty teaching asynchronous cloud cybersecurity courses at University of Maryland Global Campus. Mentoring adult learners through pre - built curriculum and real - world security expertise.
Senior incident responder leading cybersecurity investigations and digital forensics for TELUS’s national cyber resilience team. Automating response playbooks and mentoring junior responders.
Security Assurance Specialist supporting customer questionnaires, Trust Center content, and security documentation. Coordinating assurance work across Case IQ’s security, legal, compliance, product, and sales teams.
Penetration Testing Analyst testing Sun Life financial - services applications, APIs, mobile systems, and infrastructure. Supporting vulnerability remediation and foundational Red Team exercises.
Penetration Testing Analyst performing web, API, mobile, and infrastructure security testing at Sun Life. Supporting vulnerability remediation, reconnaissance, and foundational Red Team exercises.
Senior information security advisor securing a large organization’s networks, systems, Azure, and Microsoft 365 environments. Assessing cyber risks, controls, threats, and compliance frameworks.
Senior Cybersecurity Engineer securing Blackline Safety’s worker - safety technology environment. Leading cloud, identity, infrastructure, incident response, and security automation initiatives.
Physical security specialist supporting Sun Life’s financial - services mission through threat intelligence, investigations, and incident analysis. Hybrid role engaging leaders, security partners, and emergency services.
Expert en stratégie numérique d’identité et sécurité chez Beneva, assureur et fournisseur de services financiers. Définit la feuille de route d’authentification, de validation d’identité et de gestion des accès.