← All roles

Security Engineer

Mysten Labs· Security
Apply on company site
Remote$140k - $190kFull-timePosted 4d ago

About the role

Hands-on Security Engineer responsible for bug bounty programs, external audits, code and supply chain security, and building tooling to protect Mysten’s products and users across the Sui ecosystem.

Responsibilities

  • Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts. Turn recurring report classes into automated checks.
  • Own audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation.
  • Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move). Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs.
  • Own software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service. Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of what Mysten ships.
  • Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations.
  • Build security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review. Build in known-clean checks so people trust the results.

Qualifications

  • Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
  • 3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs or published research).
  • Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures.
  • Proficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code.
  • Hands-on knowledge of software supply chain attack surface: package ecosystems (npm, crates.io, PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance.
  • Solid understanding of applied cryptography fundamentals and the common ways cryptographic systems are misused in practice.
  • Experience on either side of a bug bounty program or an audit engagement.
  • Strong written and verbal communication, including the ability to influence teams you have no formal authority over.
  • Interest in the web3 space is required.

Skills

Required:Bug bounty program managementExternal audit managementCode and design reviewsSoftware supply chain security
Nice to have:Anti-scam / anti-abuse tooling

Benefits

  • Comprehensive health insurance including medical, dental, and vision covered for you and your dependents; HSAs and FSAs.
  • 18 weeks of paid Parental Leave
  • Wellbeing programs including family planning support, gender affirming care, hormone replacement therapy, mental health support and counseling, EAP
  • Short Term and Long Term Disability coverage as well as Life Insurance and Accident Insurance, and other coverage options
  • Traveler Insurance
  • 401(k)
  • Complimentary privacy protection service
  • Wellness stipend
  • Flexible paid time off and 11 paid holidays per year
  • Team offsites and annual all-company retreat
Last updated Oct 22, 2026. Interested? Apply on the company site.

About Mysten Labs

Shaping the Future of the Internet

Mysten Labs is developing crucial infrastructure to power a more decentralized internet, transforming how people connect and share information online.

infrastructureblockchainweb3decentralized internet
Company profileWebsite

More open roles at Mysten Labs