> Markdown version of [/jobs/ext/442897-security-engineer](https://www.wearedevelopers.com/jobs/ext/442897-security-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Engineer - **Company:** MOVEMENT, LLC, THE - **Location:** United States - **Contract:** Permanent contract - **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Systems Engineering, Code Review, Software Design Documents, Formal Verification, Python (Programming Language), Open Source Technology, Oracle (Applications), Pattern Recognition, Regression Testing, Rust (Programming Language), System Availability, Build Management, Solidity - **Published:** June 4, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=f2a873d8dd409575 ## About the Role Do you have experience in Research?, * Track record of finding real vulnerabilities - public audit reports, CVEs, bug bounty wins, original security research, or notable CTF results * Strong code-level security skills: you can read a Move module or a Solidity codebase and instinctively spot the dangerous path * Deep understanding of at least one smart contract VM (Move, EVM, SVM) and the classes of bugs each enables * Comfort writing real code (Move, Solidity, Rust, Python) to build security tooling - not just consume it, * Experience auditing or building Move smart contracts (Aptos, Sui, or similar) * Experience with formal verification - Move Prover, Certora, K Framework, Coq, Lean, or similar * Experience with fuzzing and invariant testing frameworks (Echidna, Foundry, Medusa, libFuzzer, AFL) * Prior experience at a top audit firm (Trail of Bits, OpenZeppelin, ChainSecurity, Spearbit, Cantina, Zellic, Sigma Prime) or in-house security at a major L1/L2 * Familiarity with EVM internals, Solidity, or Rust-based VMs (CosmWasm, Solana programs) * Published security research, conference talks, or significant open-source security tooling * Experience running or contributing to bug bounty programs at scale (Immunefi, HackerOne, Cantina) * Experience with incident response, on-call rotations, and disclosure coordination under pressure ## Description We are seeking a Security Engineer to join our core engineering team. This is a hands-on offensive and defensive role. You will audit Move modules and protocol code, build tooling that finds bugs before attackers do, and own the security posture of a production Layer 1. You will work directly with protocol, runtime, and consensus engineers - and with external auditors and the broader Move security community - to make the People's Chain one of the hardest targets in crypto. This is not a checklist-driven compliance role. This is an adversarial systems engineering role with end-to-end ownership of how the network survives contact with sophisticated, well-funded attackers. What You'll Do * Audit Move modules, protocol code (Solidity, Rust), and consensus/networking layers for vulnerabilities before they ship * Design and build security tooling: fuzzers, invariant tests, static analyzers, formal specifications, and runtime monitoring * Drive formal verification efforts using the Move Prover; write specifications for critical modules (token, staking, governance, bridge) * Threat-model the protocol end-to-end - consensus, execution, data availability, bridges, RPC, validator infrastructure * Use AI adequately to scale code review, vulnerability triage, and exploit-pattern detection across the codebase * Own the bug bounty program and triage external reports; turn findings into engineering fixes and regression tests * Lead security incident response, root cause analysis, post-mortems, and disclosure coordination * Partner with engineering teams to shift security left: secure-by-default APIs, code review standards, threat models attached to every design doc * Engage with the external security community - auditors, researchers, white-hats - and contribute back to the Move ecosystem * Stay ahead of the threat landscape: bridge exploits, MEV, signature malleability, oracle manipulation, governance attacks, validator collusion, + Smart contract vulnerability classes: access control, reentrancy and Move-equivalents, oracle manipulation, MEV, signature replay, arithmetic edge cases, upgrade hazards + Consensus security and BFT failure modes + Cryptographic primitives (signatures, hashes, ZK basics) and where they go wrong in practice + Bridge and cross-chain security * Adversarial mindset: you assume the protocol will be attacked by sophisticated, well-funded adversaries on day one * Bias toward tooling and automation: find one bug manually, then write the tool that finds the next ten ## Related Videos - [Answering the Million Dollar Question: Why did I Break Production?](https://www.wearedevelopers.com/videos/1171-answering-the-million-dollar-question-why-did-i-break-production) - [Trust as the Key Concept in Future Mobility](https://www.wearedevelopers.com/videos/581-trust-as-the-key-concept-in-future-mobility) - [Are Code Reviews Worth It? Insights from 16 Years of Review Data](https://www.wearedevelopers.com/videos/1135-are-code-reviews-worth-it-insights-from-16-years-of-review-data) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [The Environmental Impact of Software Development](https://www.wearedevelopers.com/videos/1341-the-environmental-impact-of-software-development) - [Simple Steps to Kill DevSec without Giving Up on Security](https://www.wearedevelopers.com/videos/1560-simple-steps-to-kill-devsec-without-giving-up-on-security) ## Related Articles - [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss) - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline)