Mysten Labs
Security Engineer
$140K–$190K
USA (Remote) +1 · Remote · Full-time · Posted Oct 20, 2026
- Location
- USA (Remote)
Canada (Remote) - Experience
- 3+ years of hands-on experience in security engineering, application security or product security.
- Education
- Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
About the job
Own application and product security across Mysten Labs and the Sui ecosystem, including vulnerability programs, audits, supply chain defenses, and security tooling.
What you'll do
- Run bug bounty programs and external audits, and track findings through remediation and validation.
- Review code and designs, investigate vulnerabilities and incidents, and secure software supply chains and build pipelines.
- Develop anti-abuse tools and security analysis tooling, including LLM-driven agents and static and dynamic analysis.
What they ask for
- Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
- 3+ years of hands-on security engineering, application security, or product security experience, with a track record of finding real vulnerabilities.
- Strong Web2 security fundamentals, applied cryptography knowledge, and proficiency in one or more of Rust, TypeScript, Python, or Move.
- Hands-on software supply chain security knowledge; experience on either side of a bug bounty program or audit engagement; interest in web3.
Nice to have
- Smart contract or wallet security experience; static or dynamic program analysis.
- Experience building security tooling with LLM agents; anti-phishing, anti-fraud, or trust and safety experience.
Pay
$140K – $190K (base salary; currency not stated)
Tools
Rust, TypeScript, Python, Move, Endor Labs, GitHub, GitHub Actions, CodeQL
AI focus
Build LLM-driven triage and review agents; the company may also use AI tools to help identify and evaluate candidates, with hiring decisions made by human reviewers.
Model-written summary · the original posting is authoritative