--- title: 'Security Engineer at Mysten Labs' canonical: 'https://feeny.ai/job/security-engineer-mysten-labs-united-states-tcxqqzgntrwh' type: 'job' last_seen: '2026-11-07' --- # Security Engineer at Mysten Labs - **Company:** Mysten Labs - **Location:** United States - **Employment:** full-time - **Work type:** remote - **Posted:** 2026-10-20 - **Last confirmed live:** 2026-11-07 - **Apply:** https://jobs.ashbyhq.com/mystenlabs/eb26b54f-bd8c-4bcb-ab5a-a9aafad09960 ## Job description Mysten Labs’ mission is to advance the internet through step-function improvements in what technology makes possible. We build foundational infrastructure and products that give people, businesses, and developers new ways to interact, transact, and create value. Our work spans on-chain finance and the emerging agent economy. Through Sui, Move, and our broader technology stack, we’re building the systems that make these experiences possible - from secure, scalable blockchain infrastructure to new ways for businesses and AI agents to interact. Mysten Labs is looking for a hands-on Security Engineer with strong application security fundamentals and a track record of finding and fixing real vulnerabilities. You’ll own bug bounty programs and external audits, secure our code and software supply chain, and build tooling that protects Mysten’s products and users across the Sui ecosystem. ## Responsibilities - Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts. Turn recurring report classes into automated checks. - Own audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation. - Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move). Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs. - Own software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service. Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of what Mysten ships. - Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations. - Build security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review. Build in known-clean checks so people trust the results. ## Minimum Qualifications - Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience. - 3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs or published research). - Strong Web2 security fundamentals: XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, cryptographic failures. - Proficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code. - Hands-on knowledge of software supply chain attack surface: package ecosystems (npm, [crates.io](http://crates.io), PyPI), CI/CD (GitHub Actions workflow injection, token exposure, unpinned actions), and build provenance. - Solid understanding of applied cryptography fundamentals and the common ways cryptographic systems are misused in practice. - Experience on either side of a bug bounty program or an audit engagement. - Strong written and verbal communication, including the ability to influence teams you have no formal authority over. - Interest in the web3 space is required. ## Preferred Qualifications - Smart contract or wallet security: Move, Solidity or Rust-based chains; Sui's object and capability model is a plus. - Static or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution. - Experience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling has to do the work. - Anti-phishing, anti-fraud or trust & safety experience: domain and content monitoring, crawling, classifiers, threat intelligence. - Knowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises. - Notable bug bounty rankings, CVEs, publications or conference talks. Employment is contingent upon the successful completion of a background check, which may include verification of employment history, education credentials, criminal history, and other relevant information. Regarding the recent rash of technology job scams: Be aware that emails from genuine Mysten Labs group recruiters will always come from the @[mystenlabs.com](http://mystenlabs.com) domain or related subdomains (e.g., [mystenlabs.com/careers](http://mystenlabs.com/careers)). Remember: you can always verify positions on our job boards at [www.mystenlabs.com/careers](http://www.mystenlabs.com/careers). To support an efficient and fair hiring process, we may use technology-assisted tools, including artificial intelligence (AI), to help identify and evaluate candidates. All hiring decisions are ultimately made by human reviewers. Our team is remote first and we are hiring across the world. Here at Mysten Labs, you’ll be joining a world-class team with tremendous growth potential as we bring the next billion users to web3. We raised a $300M Series B round from top Silicon Valley led venture funds like Jump Crypto, Andreessen Horowitz (a16z), Binance Labs, Redpoint, Lightspeed, Coinbase Ventures, Electric Capital, Standard Crypto, NFX, Slow Ventures, Scribble Ventures, Samsung Next, Lux Capital, among other investment firms and strategic partners. Come join us and build the future of web3! ## About Mysten Labs ## Company Overview - **One-liner**: Mysten Labs builds foundational infrastructure for a decentralized internet, including the Sui blockchain, Move programming language, and related protocols. - **Entity Type**: Private (Series B) - **Headquarters**: United States (remote-first with offices in Greece, Switzerland, UK, South Korea, Japan, and more) - **Founded**: 2021 - **Founders**: Evan Cheng (Co-Founder & CEO), Sam Blackshear (Co-Founder & CTO), Adeniyi Abiodun (Co-Founder & CPO), Kostas Chalkias (Co-Founder & Chief Cryptographer), George Danezis (Co-Founder & Chief Scientist) ## Core Business - **Primary industry**: Blockchain / Decentralized Web Infrastructure - **Target customers**: Builders, web3 enthusiasts, enterprises, and developers of decentralized applications (B2B, B2D) - **Mission or purpose statement**: "To lay the foundations for a decentralized web stack suitable for mass adoption" – unlocking everything that web3 enables. ## Products & Services - **[Sui](https://mystenlabs.com/)**: A high-performance Layer-1 blockchain and smart contract platform designed for global adoption, delivering the benefits of web3 with the ease of web2. (Infrastructure / Blockchain) - **[Move](https://mystenlabs.com/)**: The native programming language for Sui, focused on safety, composability, and extensibility for building smart contracts. (Programming Language) - **[Walrus](https://mystenlabs.com/)**: A decentralized storage and data availability protocol. (Storage / Protocol) - **[DeepBook](https://mystenlabs.com/)**: An efficient DeFi foundation that unlocks financial innovation on Sui. (DeFi / Order Book) - **[Seal](https://mystenlabs.com/)**: Robust encryption & onchain access control for sensitive data. (Security / Privacy) - **[Enoki](https://mystenlabs.com/)**: infrastructure for seamless customer experiences (mentioned in context of transforming business with meaningful customer experiences). (Developer Tools / UX) - **[Kiosk](https://mystenlabs.com/)**: A decentralized system for commerce applications on Sui. (Commerce) ## Market Standing - **Valuation/Market Cap**: Not publicly disclosed. - **Key Metric**: Total Funding – **$336 million** (as of September 2022 Series B; includes $300M Series B, $36M Series A, and ~$11K venture round). - **Notable Investors/Partners**: Andreessen Horowitz (led Series A), FTX Ventures, and 19 investors in Series B; also partnered with Qualco and xMoney (strategic alliance, May 2026). Sui processed over $1 trillion in stablecoin volume as of May 2026. - **Growth Signals**: Headcount grew **+20.8% year-over-year** (167 employees); operates in 25 countries; acquired Parasol (March 2025); Appointed ex-Goldman Digital Assets leader (May 2025); active hiring across 12+ open positions as of mid-2026. ## Competitive Advantages - **Core Differentiators**: - The **Move programming language** (originally developed at Facebook for Diem/Libra) offers superior safety and composability for smart contracts. - **Sui’s parallel execution** enables high throughput and low latency, aiming to onboard billions of users. - A **comprehensive product stack** (Sui, Walrus, DeepBook, Seal, Enoki, Kiosk) provides end-to-end infrastructure for web3. - **Scientific and engineering rigor** – the founding team includes veterans from distributed systems, cryptography, and compiler/VM research. ## Strategic Focus - **Current priorities**: Achieving mass adoption of web3 through scalable, secure, and user-friendly infrastructure. Key initiatives include zero-fee stablecoins, gaming integrations, and data privacy (Seal mainnet launched September 2025). Building the “agentic web” and interoperability foundations. ## Why Work Here - **Culture**: “Everybody carries the box” – a collaborative, no-silo environment focused on step-change advancements. Values include transparency, integrity, and thinking big. - **Remote/Hybrid**: **Remote-first** company with a global team; offers co-working opportunities, team offsites, and company-wide gatherings to stay connected. - **Interview Process**: Starts with phone interviews (45 min) covering background and interest; followed by virtual team interviews (four 45-min sessions) customized by role (systems design, coding, behavioral). Expect fast feedback (within 1 week). - **Perks**: Not explicitly listed, but emphasis on “talent shouldn’t be limited by geographic location” and a stellar team of veteran innovators. ## Sources 1. [mystenlabs.com](https://www.mystenlabs.com/) 2. [mystenlabs.com/careers](https://www.mystenlabs.com/careers) 3. [mystenlabs.com/about](https://www.mystenlabs.com/about) 4. [linkedin.com/company/mysten-labs](https://www.linkedin.com/company/mysten-labs) 5. [jobs.ashbyhq.com/mystenlabs](https://jobs.ashbyhq.com/mystenlabs) ## Other roles at Mysten Labs - [Senior Security Engineer](https://feeny.ai/job/senior-security-engineer-mysten-labs-united-states-10hv3ydqnhhp) — United States - [Enterprise Sales Lead, AI](https://feeny.ai/job/enterprise-sales-lead-ai-mysten-labs-united-states-8p4mc13kjm9e) — United States - [Product Lead, AI](https://feeny.ai/job/product-lead-ai-mysten-labs-united-states-m0r8afjkacjq) — United States - [Senior Security Engineer, DeFi](https://feeny.ai/job/senior-security-engineer-defi-mysten-labs-united-states-gnwrfp21a87r) — United States - [Software Engineer, Partner Solutions (Greece)](https://feeny.ai/job/software-engineer-partner-solutions-greece-mysten-labs-athens-office-166dx04mw2b9) — Athens Office - [Staff Product Designer, DeFi](https://feeny.ai/job/staff-product-designer-defi-mysten-labs-united-states-ahvtt57w69xm) — United States - [Associate General Counsel, Corporate](https://feeny.ai/job/associate-general-counsel-corporate-mysten-labs-united-states-32skh47dtw9y) — United States - [Staff Security Engineer, Walrus](https://feeny.ai/job/staff-security-engineer-walrus-mysten-labs-united-states-5gb0hr81t0ww) — United States - [Senior Dealmaker - AI](https://feeny.ai/job/senior-dealmaker-ai-mysten-labs-united-states-esazt7dz7fvz) — United States - [Security Engineer](https://feeny.ai/job/security-engineer-confido-new-york-st0bem187vzx) — New York, NY