Senior Application Security Engineer

Responsibilities

• Determine the root cause and severity of vulnerabilities reported through the bug bounty platform.
• Interface with ethical hackers, triage reports, and guide product engineering teams through remediation.
• Document vulnerabilities clearly so engineering teams can take rapid action.
• Write security engineering code, fix vulnerabilities in MetaMask client applications, and develop AI tooling for vulnerability determination and resolution.
• Assess application vulnerabilities and coordinate remediation within established SLAs.
• Conduct security design reviews, threat modeling, security testing, and code reviews for new product features.
• Identify gaps in the secure software development lifecycle and lead efforts to address them.
• Validate security patches and test for potential bypasses.
• Develop automation and security controls and educate developers to prevent recurring vulnerabilities.
• Participate in team meetings, roadmap planning, and security discussions.

Requirements

• At least 6 years of experience building and securing software, including hands-on product or application security experience.
• Experience securing modern backend systems, web applications, and APIs.
• Experience with threat modeling, security design reviews, and vulnerability assessment.
• Experience securing JavaScript-based web or mobile applications, preferably using Node.js, React, or React Native.
• Strong coding skills and the ability to identify and fix vulnerabilities or build secure solutions alongside engineers.
• Familiarity with blockchain technology, particularly Ethereum, decentralized applications, and crypto wallets.
• Solid understanding of modern web and mobile security threats, attack vectors, and mitigations.
• Strong communication, collaboration, self-direction, and ability to work in a distributed team.
• Preferred qualifications include software development experience and deep knowledge of Ethereum, other blockchains, decentralized applications, crypto wallets, and smart contract implementation and security.
• Applicants must be able to work with some overlap across EU and US-Pacific time zones; candidates based in France, Italy, or Germany are not considered.

Benefits

• Remote-first, global work environment with most time zones supported, subject to EU and US-Pacific overlap.
• US base salary range is $130,000-$218,000 annually, excluding bonus, equity, and other benefits; compensation outside the US is determined by location, experience, and skills.
• Equal opportunity employer with a commitment to diversity and inclusion.
• Employment may require background and identity verification checks.