Senior Security Engineer

Mysten Labs is building foundational infrastructure for the next generation of the internet, with a focus on blockchain technology and the emerging AI agent economy. The company develops Sui, Move, and complementary systems that enable secure, scalable on-chain applications and new forms of interaction between businesses, developers, and autonomous agents. This is a remote, full-time position on the Security team.

What you'll do

• Build and maintain the Security Observability and Data Platform, handling ingestion, normalization, and retention of tens of terabytes monthly, plus design the detection and query layer where detections are written as tested, reviewed code with measured precision.

• Manage endpoint security across the infrastructure fleet: deploy and tune EDR solutions, implement binary authorization, establish hardening baselines with IT Operations, and conduct end-to-end incident response including triage, containment, forensics, and root cause analysis.

• Lead threat hunting, insider-threat investigations, and red-team exercises that inform detections and preventive controls.

• Design and operate next-generation security services in production: zero-trust authentication and authorization, blocking services, application proxies, asset inventory systems, developer portals, and compliance automation.

• Build and run an agent platform using LLM agents for automated triage, enrichment, investigation, and response, layering deterministic checks where model outputs require verification.

• Review infrastructure and cloud security designs across Kubernetes, AWS, GCP, bare metal, and CI runners, helping teams adopt shared security services.

• Write comprehensive runbooks and incident post-mortems that enable response at any hour.

What you'll bring

• Bachelor's degree in Computer Science, Computer Engineering, related technical field, or equivalent hands-on experience.

• Five or more years in security engineering, detection and response, or infrastructure and SRE with security focus, including practical incident response on endpoints and in cloud environments.

• Hands-on experience operating EDR tools and writing detections; deep knowledge of macOS and Linux internals including persistence mechanisms, credential theft, process injection, and living-off-the-land techniques.

• Production experience building or operating telemetry pipelines and SIEM or security data lakes at terabyte scale, with strong SQL skills for detection logic across large datasets.

• Proven production engineering capabilities: Linux, containers, Kubernetes, major public cloud platforms, infrastructure as code, monitoring and alerting.

• Proficiency in Python or Go with comfort working in Rust or willingness to learn it.

• Working knowledge of identity systems including SSO (OIDC/SAML), phishing-resistant MFA, device trust, and token and session theft mechanisms.

• Strong written communication for managing incidents and documenting post-mortems.

• Genuine interest in the web3 space.

Nice to have

• Experience implementing zero-trust access controls, identity-aware proxies, or policy engines.

• Fleet-scale binary authorization or allowlisting experience.

• Familiarity with threat actors targeting crypto companies and their tactics.

• Digital forensics expertise (memory, disk, macOS unified logs) and malware analysis skills.

• Experience building security tooling with LLM agents and judgment about where models add value versus where deterministic systems are required.

• Compliance as code implementation and experience in ISO 27001 or SOC 2 environments.

What they offer

• Remote work across the world with a distributed-first team structure.

• Opportunity to work alongside a world-class security team in a high-growth organization backed by major venture capital firms including Andreessen Horowitz, Jump Crypto, Binance Labs, and others.