Super Complicated Job Requirements

Honestly, JDs like this happen for two reasons: either the team wants a one-man security department to save money, or HR just combined three different security roles into one post.

To answer your question: yes, absolutely apply. Most projects will happily take someone who is genuinely good at smart contract security and teach them the basics of API/Web2 testing on the job.

If you have proof of work (Immunefi submissions, audit reports, CTFs), that matters way more than checking every single buzzword on a generic JD. Don’t filter yourself out.

Honestly just go ahead and apply.

Most of these vague JDs happen because non-tech founders or HR literally Google "security requirements" and copy-paste everything into one post. They want a unicorn on a single salary.

I would say "don't try to fake the web2/mobile stuff. Put your smart contract audits or CTF stuff right at the top of your resume. When you get on the call, just be upfront: "Look, my core strength is finding protocol-draining bugs in solidity/EVM. I know the basics of web attack vectors, but on-chain logic is my actual edge."

Any tech lead with a brain knows finding good smart contract auditors is 10x harder than finding standard web pentesting. and honestly, if they reject you because you can't reverse engineer an iOS app while securing their DeFi pools, you probably dodged a mess of a job where you'd be blamed for everything.

Curious if anyone here got hired for a hybrid role like this and actually had to do both?