Security Engineer (Web3)

Location: Remote in the USA or Canada.

Salary: $140,000–$190,000 annual US base salary, plus tokens, equity compensation, benefits, and eligibility for annual equity and token refresh grants.

Company

hirify.global creates foundational infrastructure for decentralized protocols based on blockchain technologies and develops the Sui ecosystem.

What you will do

• Run bug bounty programs, including triage, severity assessment, responses, escalations, fix validation, budgeting, payouts, and automation of recurring report classes.
• Own external audit engagements by defining scope and schedules, serving as the technical counterpart, and tracking findings through remediation and validation.
• Review the code and designs of systems built by Mysten, its subsidiaries, and partners using Rust, TypeScript, and Move; investigate incidents and perform variant analysis.
• Secure the software supply chain, including dependencies, CI/CD pipelines, GitHub controls, merge bots, build provenance, and package or maintainer compromise response.
• Build anti-scam, anti-abuse, and security tooling for the Sui ecosystem, including detection of phishing sites, malicious dApps, drainer contracts, taint analysis, call graphs, fuzzing, and CI-integrated review tools.

Requirements

• Bachelor’s degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
• 3+ years of hands-on experience in security engineering, application security, or product security, with demonstrated vulnerability findings such as bug bounty reports, audit findings, CVEs, or published research.
• Strong Web2 security fundamentals, including XSS, CSRF, SSRF, authorization flaws, injection, deserialization, software supply chain failures, and cryptographic failures.
• Proficiency in one or more of Rust, TypeScript, Python, or Move, with experience reviewing and writing security-sensitive code.
• Hands-on knowledge of software supply chain attack surfaces, including npm, crates.io, PyPI, GitHub Actions workflow injection, token exposure, unpinned actions, and build provenance.
• Understanding of applied cryptography fundamentals and common practical cryptographic misuse.
• Experience on either side of a bug bounty program or audit engagement.
• Strong written and verbal communication skills, including influencing teams without formal authority.
• Interest in the Web3 space is required.

Nice to have

• Smart contract or wallet security experience with Move, Solidity, or Rust-based chains; knowledge of Sui’s object and capability model is a plus.
• Experience with CodeQL, Semgrep, taint analysis, fuzzing, or symbolic execution.
• Experience building security tooling with LLM agents, including Claude Code skills or comparable tools, and understanding where deterministic tooling is required.
• Anti-phishing, anti-fraud, or trust and safety experience involving domain and content monitoring, crawling, classifiers, or threat intelligence.
• Knowledge of recent crypto incidents and related defect classes, including drainer kits, DeFi frontend compromises, and package-registry compromises.
• Notable bug bounty rankings, CVEs, publications, or conference talks.

Culture & Benefits

• Remote-first work environment with hiring across the world, while this role lists remote locations in the USA and Canada.
• US health insurance covering medical, dental, and vision for employees and dependents, with HSA and FSA options.
• 18 weeks of paid parental leave, flexible paid time off, and 11 paid holidays per year.
• Wellbeing programs, mental health support, counseling, disability and life insurance, traveler insurance, privacy protection, and a wellness stipend.
• 401(k), tokens, equity compensation, and eligibility for annual equity and token refresh grants.
• Team offsites and an annual all-company retreat.