Security Engineer

Role: Security Engineer

Security engineers at Mysten Labs own operational and software security for the Sui blockchain, wallets, the Move language, and other Mysten systems.

Responsibilities

• Maintain and improve custody systems for validator keys, operational keys, and important on-chain objects, including:
  • key generation, storage, access controls
  • signing workflows, aggregation
  • rotation and recovery procedures
• Harden the signing path end-to-end by reviewing and improving code, infrastructure, and operational practices for transaction authorization, review, and on-chain submission.
• Build anti-scam/anti-abuse tooling for the Sui ecosystem, such as detecting:
  • phishing sites, malicious dApps, drainer contracts, and other threats
  • partner with wallet ecosystem teams on mitigations
• Conduct code and design reviews for components handling sensitive keys or on-chain assets, focusing on:
  • cryptographic correctness
  • access control
  • operational safety
• Investigate and respond to security issues/incidents involving custody or ecosystem abuse, and drive fixes to prevent recurrence.
• Serve as a key point of contact for audit engagements and bug bounty reports.

Requirements (Preferred Qualifications)

• 3+ years hands-on experience in security engineering, application security, or product security.
• Knowledge of key management in production, e.g. HSMs, cloud KMS, MPC/threshold-signature, hardware wallets, or comparable custody infrastructure.
• Proficiency in one or more of:
  • Rust, TypeScript, Python, or Move
  • experience reviewing and writing security-sensitive code
• Strong understanding of applied cryptography fundamentals and common real-world cryptographic misuse.
• Builder mentality: comfortable with ambiguity, diving into unfamiliar codebases, and shipping fixes directly.
• Strong communication to explain findings to both technical engineers and non-technical stakeholders.
• Interest in web3; prior experience in crypto/fintech or other regulated/high-stakes environments is a plus.

Notes

• Employment is contingent on successful completion of a background check.
• Remote-first team; company indicates it is hiring globally.