Security Engineer

Responsibilities

• Run Mysten's bug bounty programs: triage, severity, responses, internal escalations, fix validation, and the budget and payouts. Turn recurring report classes into automated checks.
• Own audit engagements: scope and schedule external audits, act as the technical counterpart during the engagement, and track findings through remediation and fix validation.
• Conduct code and design reviews of systems built by Mysten, its subsidiaries and partners (Rust, TypeScript, Move).
• Drive issues to conclusion, including investigation and incident response, and run variant analysis so each bug class is closed everywhere it occurs.
• Own software supply chain security: dependency and CI/CD malware defenses, Endor Labs, the code security service (GitHub controls, merge bots), and the ongoing code security self-auditing service. Detect and respond to compromised packages, maintainers and build pipelines, and secure the provenance and signing of what…
• Build and improve anti-scam and anti-abuse tooling for the Sui ecosystem: detect phishing sites, malicious dApps, drainer contracts and other threats that target Sui users, and work with wallet teams on mitigations.
• Build security tooling: LLM-driven triage and review agents, and static and dynamic analysis (taint, call graphs, fuzzing) wired into CI and code review.
• Build in known-clean checks so people trust the results.

Languages