Senior Manager, Application Security

ConsenSys is a leading infrastructure company building developer platforms and applications for the decentralized web. The organization operates at the intersection of blockchain technology and financial services, serving millions of users globally through its MetaMask product suite and broader Web3 ecosystem tools. ConsenSys combines technical depth with a mission to advance open finance and user sovereignty.

This Senior Manager, Application Security role sits within the Office of the COO at ConsenSys and leads the application security function for MetaMask's browser extension, mobile applications, Snaps framework, backend services, DeFi primitives, stablecoins and associated smart contracts. You will own the full security lifecycle from design through vulnerability management, building and leading a small senior team while staying hands-on with code review and threat modeling. This position reports to the Head of Security and partners closely with engineering leadership across the organization.

What you'll do

• Build and develop the Application Security team through hiring, performance management and career development while maintaining direct involvement in technical security work and code reviews.

• Define and execute the Application Security strategy, establish annual goals and quarterly OKRs aligned with company priorities, and track KPIs that measure security coverage, remediation velocity and risk reduction.

• Lead threat modeling and security design reviews across browser clients, mobile applications, APIs and backend services, with specific focus on authentication, key management, signing and delegated action patterns.

• Establish software supply chain security standards and controls for dependencies, build systems, artifacts and publishing pipelines, working with engineering teams to validate implementation.

• Design and maintain a secure development lifecycle that accounts for AI agents, including access controls, action boundaries and human review checkpoints, and set security standards for AI development tools and generated code.

• Own application vulnerability assessment, triage, prioritization and remediation tracking, correlating findings across clients and services to assess combined impact and escalating overdue risks.

• Manage bug bounty and penetration testing programs, including scope definition, external provider selection and researcher relationships.

What you'll bring

• At least eight years of application security or security-focused software engineering experience, with a minimum of two years leading technical people.

• Strong practical code review capabilities in TypeScript/JavaScript, Go or Solidity, with demonstrated ability to identify vulnerabilities in browser extensions, mobile applications and backend services.

• Proven experience securing distributed systems with authentication, authorization and key management across client and backend architectures.

• Track record building or substantially improving application security programs, including security reviews, automated testing, vulnerability management and developer enablement.

• Hands-on experience with software supply chain security, including dependency policies, software composition analysis, npm ecosystems and CI/CD controls.

• Working knowledge of EVM smart contract security, including common vulnerability patterns, review methodologies and assessment of external audits.

• Demonstrated ability to drive security improvements through engineering teams outside your direct reporting line.

Nice to have

• Experience integrating AI-powered security scanning and validating the accuracy of AI-generated findings.

• Familiarity with secure coding training programs and security champions models.

What they offer

• Fully remote position based in EMEA region.

• Full-time permanent role on ConsenSys' leadership team.