Senior Application Security Engineer

Role Description

MetaMask has experienced explosive user growth over the past year as a cryptographic key manager and web3 application development platform. As this user base continues to grow, an immense amount of trust is being placed in MetaMask as a tool that manages and wields their digital authority, controlling assets, identities, and more. It is of highest importance to us that we keep our users as safe and secure as possible.

We are looking for a Senior Application Security Engineer to join our rapidly growing security team to help embed security into all phases of the software development lifecycle. You would work closely with development teams and product managers to ensure MetaMask products are designed and implemented to the highest security standards. Consenys’s application security team primarily supports MetaMask with opportunities to expand to additional products in the Consensys family.

Qualifications

• 6+ years of experience building and securing software, including hands-on product or application security experience.
• Experience securing modern backend systems, web applications, and APIs.
• Experience performing threat modelling, security design reviews, and vulnerability assessment.
• Experience securing JavaScript-based applications across web and/or mobile (Node.js, React, React Native preferred).
• Strong coding skills, with the ability to work directly with engineers to identify and fix vulnerabilities or build secure solutions.
• Familiarity with Blockchain technology (particularly Ethereum), Decentralized Applications, and crypto wallets.
• Solid understanding of the modern web and mobile security landscape, including common attack vectors and mitigations.
• Strong communication skills, with the ability to influence engineering decisions and collaborate effectively in a remote environment.
• Self-driven and proactive, comfortable operating in a high-autonomy, distributed team.
• Alignment with our mission and values.

Requirements

• Timezone: Most timezones will work. Some overlap with EU and US-Pacific time zones will be necessary.

Responsibilities

• Determine the root cause and severity of vulnerabilities reported to us through our bug bounty platform.
• Interface with ethical hackers, triage reports, and guide product engineering teams to resolution.
• Document identified vulnerabilities in a way that allows for our engineering team to take quick action.
• Write code to support the development of security engineering projects, or fix vulnerabilities in MetaMask client applications.
• Assess potential security vulnerabilities within our applications, and work with development teams to ensure remediation in our established SLAs.
• Support product teams as they develop new features by conducting design reviews, threat modeling, security testing, and code reviews.
• Identify gaps in MetaMask’s secure software development life cycle (SSDLC), and take initiative leading efforts to address them.
• Participate and contribute to team meetings, roadmap planning, and discussions.
• Validate that security patches address reported vulnerabilities and test for any potential bypasses.
• Proactively prevent future occurrences of a vulnerability through developing automation, security controls, and educating developers.
• Pave your own path in how you want to make MetaMask more secure.

Benefits

• US pay range (not including bonus, equity or other benefits): $130,000 — $218,000 USD.