{"id":2958544,"url":"https://alion.io/job/mysten-labs-security-engineer","title":"Security Engineer","company":{"id":47448,"name":"Mysten Labs","domain":"mystenlabs.com","url":"https://alion.io/company/mysten-labs","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US","CA"],"hiring_countries_total":2,"salary":{"min":140000,"max":190000,"currency":"USD","period":"year","gross":null,"usd_annual":190000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"LLM","optional":false},{"name":"Move","optional":false},{"name":"npm","optional":false},{"name":"Python","optional":false},{"name":"Rust","optional":false},{"name":"Sui","optional":false},{"name":"TypeScript","optional":false},{"name":"AI Agents","optional":true},{"name":"Claude Code","optional":true},{"name":"CodeQL","optional":true},{"name":"DeFi","optional":true},{"name":"JavaScript","optional":true},{"name":"Semgrep","optional":true},{"name":"Smart Contracts","optional":true},{"name":"Solidity","optional":true}],"status":"live","first_seen_at":"2026-10-20T19:31:52Z","employer_posted_date":"2026-10-20","last_verified_at":"2026-10-22T15:13:26Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"Mysten Labs’ mission is to advance the internet through step-function improvements in what technology makes possible. We build foundational infrastructure and products that give people, businesses, and developers new ways to interact, transact, and create value.\nOur work spans on-chain finance and the emerging agent economy. Through Sui, Move, and our broader technology stack, we’re building the systems that make these experiences possible - from secure, scalable blockchain infrastructure to new ways for businesses and AI agents to interact.\nMysten Labs is looking for a hands-on Security Engineer with strong application security fundamentals and a track record of finding and fixing real vulnerabilities. You’ll own bug bounty programs and external audits, secure our code and software supply chain, and build tooling that protects Mysten’s products and users across the Sui ecosystem.\nResponsibilities\nRun Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts. Turn recurring report classes into automated checks.\n\nOwn audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation.\n\nConduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move). Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs.\n\nOwn software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service. Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of what Mysten ships.\n\nBuild and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations.\n\nBuild security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review. Build in known-clean checks so people trust the results.\n\nMinimum Qualifications\nBachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.\n\n3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs or published research).\n\nStrong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures.\n\nProficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code.\n\nHands-on knowledge of software supply chain attack surface: package ecosystems (npm, crates.io, PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance.\n\nSolid understanding of applied cryptography fundamentals and the common ways cryptographic systems are misused in practice.\n\nExperience on either side of a bug bounty program or an audit engagement.\n\nStrong written and verbal communication, including the ability to influence teams you have no formal authority over.\n\nInterest in the web3 space is required.\n\nPreferred Qualifications\nSmart contract or wallet security: Move, Solidity or Rust-based chains; Sui's object and capability model is a plus.\n\nStatic or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution.\n\nExperience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling has to do the work.\n\nAnti-phishing, anti-fraud or trust & safety experience: domain and content monitoring, crawling, classifiers, threat intelligence.\n\nKnowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises.\n\nNotable bug bounty rankings, CVEs, publications or conference talks.\n\nEmployment is contingent upon the successful completion of a background check, which may include verification of employment history, education credentials, criminal history, and other relevant information.\nRegarding the recent rash of technology job scams: Be aware that emails from genuine Mysten Labs group recruiters will always come from the @ mystenlabs.com domain or related subdomains (e.g., mystenlabs.com/careers). Remember: you can always verify positions on our job boards at www.mystenlabs.com/careers.\nTo support an efficient and fair hiring process, we may use technology-assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers.\nOur team is remote first and we are hiring across the world. Here at Mysten Labs, you’ll be joining a world-class team with tremendous growth potential as we bring the next billion users to web3. We raised a $300M Series B round from top Silicon Valley led venture funds like Jump Crypto, Andreessen Horowitz (a16z), Binance Labs, Redpoint, Lightspeed, Coinbase Ventures, Electric Capital, Standard Crypto, NFX, Slow Ventures, Scribble Ventures, Samsung Next, Lux Capital, among other investment firms and strategic partners. Come join us and build the future of web3!","description_format":"text","description_chars":5597,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Smart Contracts & Security","Blockchain Infrastructure"],"lifecycle":[{"event":"open","at":"2026-10-20T22:15:53Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 3 · green card filings: 1","filings_12m":3,"filings_prev_12m":5,"green_card_filings_12m":1,"median_offered_wage_usd":226250,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":40,"reasons":["conf:2","velocity","win:early"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":190000,"is_top_pay":true},"html_url":"https://alion.io/job/mysten-labs-security-engineer","json_url":"https://alion.io/job/mysten-labs-security-engineer.json","meta":{"generated_at":"2026-10-22T15:32:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15332,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":47448},"rest":"https://alion.io/mcp/rest/get_company?id=47448"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmysten-labs-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmysten-labs-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmysten-labs-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/mysten-labs-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmysten-labs-security-engineer"}]}