Senior Application Security Engineer

Details

Consensys is seeking a Senior Application Security Engineer to join its remote, globally distributed security team. The role will primarily support MetaMask, a crypto wallet and decentralized application development platform, with opportunities to expand support to other Consensys products.

The engineer will help embed security throughout the software development lifecycle and work closely with development teams and product managers to ensure MetaMask products meet high security standards. The role requires overlap with EU and US-Pacific time zones.

Responsibilities

• Determine the root cause and severity of vulnerabilities reported through the bug bounty platform.
• Interface with ethical hackers, triage reports, and guide product engineering teams toward resolution.
• Document vulnerabilities so engineering teams can take quick action.
• Write code for security engineering projects and fix vulnerabilities in MetaMask client applications.
• Develop AI tooling for vulnerability determination and resolution in response to the evolving AI-powered vulnerability detection landscape.
• Assess potential application security vulnerabilities and work with development teams to remediate them within established service-level agreements.
• Conduct design reviews, threat modeling, security testing, and code reviews for new product features.
• Identify gaps in MetaMask's secure software development lifecycle and lead efforts to address them.
• Participate in team meetings, roadmap planning, and technical discussions.
• Validate security patches and test for potential bypasses.
• Prevent recurrence of vulnerabilities by developing automation and security controls and educating developers.

Requirements

• At least 6 years of experience building and securing software, including hands-on product or application security experience.
• Experience securing modern backend systems, web applications, and APIs.
• Experience with threat modeling, security design reviews, and vulnerability assessment.
• Experience securing JavaScript-based web or mobile applications; Node.js, React, and React Native are preferred.
• Strong coding skills and the ability to work directly with engineers to identify and fix vulnerabilities or build secure solutions.
• Familiarity with blockchain technology, particularly Ethereum, decentralized applications, and crypto wallets.
• Solid understanding of modern web and mobile security, including common attack vectors and mitigations.
• Strong communication skills and the ability to influence engineering decisions in a remote environment.
• A self-driven and proactive approach, with comfort working in a high-autonomy, distributed team.
• Alignment with Consensys's mission and values.
• Applicants must be able to overlap with EU and US-Pacific time zones.

Nice to Have

• Experience working as a software developer.
• Deep knowledge of Ethereum and other blockchains, decentralized applications, and crypto wallets.
• Knowledge of smart contract implementation and security.
• Experience using MetaMask.

Additional Information

Employment requires background checks, including employment, education, and criminal record checks. The listed salary range applies to US-based candidates only. Compensation for candidates outside the US, including Canada, EMEA, and LATAM, will be determined based on location, experience, and skills during the interview process.

Consensys is an equal opportunity employer.

Benefits

• Competitive benefits package.
• Equity for employees.
• Continuous learning and development opportunities through the Consensys Advance Program, including access to Coursera and other learning programs.
• Unlimited vacation and holidays.
• Company-wide zero-productivity days.
• Flexible, asynchronous working arrangements.
• Remote-first work with a globally distributed team across six continents.