Senior Security Engineer, DeFi

Mysten Labs is building foundational blockchain infrastructure to enable decentralized protocols at scale. The company raised a $300M Series B from top-tier investors including Andreessen Horowitz and Jump Crypto, and is focused on bringing web3 adoption to the mainstream. Mysten is known for creating the Sui blockchain, which emphasizes developer experience and horizontal scalability through its unique object model and Move language.

This is a full-time remote role on Mysten's Security team. You'll be the engineer protecting the Sui DeFi ecosystem from vulnerabilities, monitoring economic risks, and working with both external protocol teams and Mysten's own DeFi products like DeepBook.

Your day-to-day work includes

• Running continuous monitoring across Sui's DeFi ecosystem to catch security and economic issues: oracle problems, bad configurations, solvency exposure, liquidation capacity against available liquidity, and accounting discrepancies.

• Extending the security team's analysis tools, including static analysis systems and proprietary agent-based capabilities.

• Owning the DeFi security compliance program: managing recurring audits, maintaining the protocol report card, validating security claims against on-chain reality, tracking fixes, and escalating regressions or unreported incidents.

• Hunting for critical vulnerabilities in high-TVL protocols before they're exploited through audits, variant analysis, multisig payload review, and incident forensics.

• Serving as the security team's liaison with external DeFi teams and Mysten's products, handling due diligence, incident response, and post-mortems.

• Documenting findings, reports, and runbooks that both engineers and non-technical stakeholders can understand and act on.

You'll bring at least 3 years of hands-on security engineering, smart contract security, or DeFi risk work with a proven track record of building production tools and discovering real vulnerabilities. You understand DeFi mechanics deeply: lending markets, AMMs, perpetuals, oracles, flash loans, and MEV. You're proficient in TypeScript and Python, comfortable with Rust, and can read smart contracts at the source or bytecode level. You verify claims against chain state and bytecode, build rigorous checks into your tools, and communicate clearly with teams you don't have formal authority over. Interest in web3 is essential.

Nice to have

• Sui and Move experience, including the object model, package upgrades, and Sui's GraphQL and gRPC APIs.

• Knowledge of recent DeFi exploits and the vulnerability classes behind them.

• Experience building monitoring or analysis tools with LLM agents.

• Program analysis expertise: taint analysis, fuzzing, symbolic execution, or formal verification.

• Economic modeling, stress testing, or liquidity modeling experience.

• Published security research, CVEs, or bug bounty track record.