Mysten Labs

Mysten Labs

Security Engineer

USA (Remote) · Mid · Contract

Sponsorship not specifiedDetected 3 days ago
TypeScriptPythonRustGitCI/CDGitHub ActionsLLMsAgentic AICybersecurityIncident ResponseAuditingSupply ChainResearchCommunication

Stay score

odds of building a lasting career here

37Risky
Cap-exempt (no lottery)0
Sponsors this role80
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Files H-1B transfers

2 transfer filings in the last year, covering 2 workers. Median labor-condition decision: 8 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • Our work spans on-chain finance and the emerging agent economy.
  • Mysten Labs is looking for a hands-on Security Engineer with strong application security fundamentals and a track record of finding and fixing real vulnerabilities.
  • Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts.

Responsibilities

  • Own audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation.
  • Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move).
  • Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs.
  • Own software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service.
  • Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of what Mysten ships.
  • Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations.
  • Build security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review. Build in known-clean checks so people trust the results.
  • We build foundational infrastructure and products that give people, businesses, and developers new ways to interact, transact, and create value.
  • Through Sui, Move, and our broader technology stack, we're building the systems that make these experiences possible - from secure, scalable blockchain infrastructure to new ways for businesses and AI agents to interact.
  • You'll own bug bounty programs and external audits, secure our code and software supply chain, and build tooling that protects Mysten's products and users across the Sui ecosystem.

Requirements

  • Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
  • 3+ years of hands-on experience in security engineering, application security or product security, with a track record of finding real vulnerabilities (bug bounty reports, audit findings, CVEs or published research).
  • Proficiency in one or more of Rust, TypeScript, Python or Move, and experience reviewing and writing security-sensitive code.
  • Experience on either side of a bug bounty program or an audit engagement.
  • Strong written and verbal communication, including the ability to influence teams you have no formal authority over.
  • Interest in the web3 space is required.

Nice to have

  • Smart contract or wallet security: Move, Solidity or Rust-based chains
  • Sui's object and capability model is a plus.
  • Static or dynamic program analysis: CodeQL, Semgrep, taint analysis, fuzzing, symbolic execution.
  • Anti-phishing, anti-fraud or trust & safety experience: domain and content monitoring, crawling, classifiers, threat intelligence.
  • Knowledge of recent crypto incidents and the defect classes behind them: drainer kits, DeFi frontend compromises, package-registry compromises.
  • Notable bug bounty rankings, CVEs, publications or conference talks.
  • Remember: you can always verify positions on our job boards at www.mystenlabs.com/careers http://www.mystenlabs.com/careers.
  • All hiring decisions are ultimately made by human reviewers.

Company info

  • Our team is remote first and we are hiring across the world.
  • Mysten Labs' mission is to advance the internet through step-function improvements in what technology makes possible.
Apply directly at Mysten Labs →Create a free account for alerts like thisView Mysten Labs immigration profile

This listing is sourced directly from Mysten Labs's careers page and normalized into a canonical job model.