Mysten Labs creates foundational infrastructure to accelerate the global adoption of decentralized protocols and web3 technologies. Founded by former senior executives and lead architects of Meta’s Novi research team, Mysten Labs is the original creator and core contributor behind Sui—a high-throughput, object-centric Layer-1 blockchain—and decentralized primitives like DeepBook and Walrus.

Role Summary

Mysten Labs is looking for a Senior Security Engineer, DeFi to safeguard the Sui blockchain ecosystem. In this role, you will uncover protocol vulnerabilities, build real-time monitoring and detection tooling, and evaluate economic risks across decentralized financial applications. Working alongside external protocol development teams as well as Mysten’s internal DeFi initiatives (including DeepBook), you will identify vulnerabilities before they can be exploited and elevate security standards across the ecosystem.

Key Responsibilities

Vulnerability Discovery & Triage: Identify, audit, and analyze deep technical vulnerabilities across Move-based smart contracts, automated market makers (AMMs), lending protocols, and order books.
Economic & Attack-Vector Risk Assessment: Model flash loans, oracle manipulation, collateral liquidations, and economic exploits under extreme market volatility.
Security Tooling & Monitoring: Design and build automated static/dynamic analysis tools, fuzzers, and on-chain telemetry to catch anomalies in real time.
Actionable Reporting & Runbooks: Author clear, high-rigor security findings, post-mortems, and incident runbooks traceable to bytecode, transaction logs, and chain state.
Incident Response & Ecosystem Advisory: Advise partner engineering teams on secure contract architecture, safe upgrade paths, and incident response mitigation.

Requirements & Qualifications

Must-Haves

DeFi Security Expertise: Strong track record auditing, breaking, or securing production smart contracts and complex DeFi protocols.
Technical Rigor: Ability to trace vulnerabilities directly to bytecode and chain state, write reproducible proof-of-concept exploits, and build verified security checks.
Protocol Communication: Strong written and verbal communication skills with the ability to influence external protocol developers and guide them toward safe architectural patterns.
Web3 Fluency: Deep domain familiarity with decentralized finance mechanisms, liquidity dynamics, and on-chain attack surfaces.
Location: Must be located in and authorized to work remotely within the United States or Canada.

Nice-to-Haves

Experience with program analysis techniques (symbolic execution, taint analysis, fuzz testing, or formal verification).
Hands-on experience with Move or Rust (or deep Solidity/EVM security background with an eagerness to master Move).
History of CVE disclosures, top rankings in web3 bug bounties (e.g., Immunefi), or published security research.
Quantitative financial modeling or economic stress-testing experience for collateralized lending or perpetual markets.

Compensation & Benefits

Annual Base Salary: $165,000 – $225,000 USD
Remote Culture: Fully remote setup across the US and Canada with collaborative team tooling and flexible autonomy.
High Impact: Direct ownership over securing multi-billion-dollar decentralized financial infrastructure