> Markdown version of [/jobs/ext/3876050-security-engineer](https://www.wearedevelopers.com/jobs/ext/3876050-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Engineer

- **Company:** Mysten Labs
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, Apple Mac Systems, Big Data, Computer Engineering, Data Infrastructure, Linux, Digital Forensics, Information Technology Operations, Python (Programming Language), Linux Kernel, Open Source Technology, OpenID, Anti-Phishing, Standard Sql, Security Assertion Markup Language (SAML), Security Information and Event Management, Large Language Models, Claude Code, Malware, Data Lakes, Kubernetes, Information Technology, Cybercrime, Bare Metal, Web3.js, CIS Benchmarks
- **Published:** October 22, 2026
- **Apply:** https://startup.jobs/senior-security-engineer-mysten-labs-2-10543419

## About the Role

* Bachelor's degree in Computer Science, Computer Engineering, a relevant technical field, or equivalent practical experience.
 * 5+ years in security engineering, detection and response, or infrastructure/SRE with a security focus, including hands-on incident response on endpoints and in the cloud.
 * Experience operating an EDR, writing and tuning detections. Knowledge of macOS and Linux internals as attackers use them: persistence, credential theft, process injection, living-off-the-land binaries.
 * Experience building or operating telemetry pipelines and a SIEM or security data lake at TB scale. Strong SQL, including detection logic over large datasets.
 * Hands-on production engineering: Linux, containers, Kubernetes, at least one major public cloud, infrastructure as code, monitoring and alerting.
 * Proficiency in Python or Go, and comfort with Rust or willingness to work in it (most of Mysten's stack are Rust).
 * Working knowledge of identity: SSO (OIDC/SAML), phishing-resistant MFA, device trust, and how session and token theft work.
 * Strong written communication: can run an incident channel and write the post-mortem.
 * Interest in the web3 space is required., * Experience building zero-trust access, identity-aware proxies or policy engines.
 * Binary authorization or allowlisting at fleet scale
 * Familiarity with the threat actors that target crypto companies and their methods, from social engineering and fake campaigns to supply chain compromises.
 * Digital forensics (memory, disk, macOS unified logs) and malware analysis.
 * Experience building security tooling with LLM agents (Claude Code skills or comparable), and a clear sense of where models help and where deterministic tooling has to do the work.
 * Compliance as code (CIS benchmarks); experience in ISO 27001 or SOC 2 environments.
 * Publications, conference talks or open-source security tooling.

Employment is contingent upon the successful completion of a background check, which may include verification of employment history, education credentials, criminal history, and other relevant information.

## Description

* Build and operate the Security Observability & Data Platform (tens of TB/month and growing). This covers ingestion, normalization and retention, plus the query and detection layer on top. Detections are code: tested, reviewed, and measured for precision.
 * Own endpoint security across the fleet: deploy, tune and respond with EDR; run and configure binary authorization; and set hardening baselines with IT Operations.
 * Lead threat hunting, internal investigations and insider-threat work. Handle security incidents end to end: triage, containment, forensics, root cause, and the control that prevents a repeat.
 * Build the next generation of security services and run them in production: zero-trust AuthN/AuthZ, a uniform blocking service, an application proxy, asset inventory, developer portal, and compliance as code.
 * Build and run the agent platform (local and Kubernetes). Use LLM agents to automate triage, enrichment, investigation and response, with deterministic checks wherever a model's answer isn't enough.
 * Review infrastructure and cloud designs (Kubernetes, AWS/GCP, bare metal, CI runners) for security, and help engineering teams adopt the shared services instead of building their own.
 * Run red-team and adversary-emulation exercises, and turn the results into detections and fixes.
 * Write runbooks and post-mortems that someone who wasn't in the room can follow at 3 a.m.