10 hours ago
Remote, EMEAStaff+
Responsibilities
- Lead and develop the Application Security team through hiring, performance management, and career development while remaining hands-on technically.
- Set AppSec strategy, goals, OKRs, KPIs, and leadership reporting for coverage, remediation, and material risks.
- Lead threat modeling, security design reviews, architecture and RFC reviews, and code reviews across clients, APIs, backend services, and smart contracts.
- Define and validate secure software supply chain, build, dependency, artifact, publishing, and release controls.
- Evolve the secure development lifecycle and security standards for AI development tools, generated code, and AI components.
- Integrate and evaluate static analysis, dynamic analysis, dependency scanning, secrets detection, and AI security scanning.
- Own application vulnerability assessment, triage, prioritization, remediation tracking, fix verification, and escalation.
- Manage bug bounty, penetration testing, external security providers, researcher relationships, rewards, payouts, and vulnerability disclosure.
- Provide application security evidence for audits and due diligence and support vulnerability analysis and remediation during incidents.
Requirements
- At least eight years of experience in application security or software engineering with a security focus, including at least two years leading people.
- Strong practical code review skills in TypeScript/JavaScript, Go, or Solidity across browser extensions, mobile applications, and backend services.
- Experience securing applications across clients and backend services, including distributed authentication, authorization, and key management.
- Experience building or substantially improving an AppSec program covering security reviews, automated testing, AI scanning, vulnerability management, and developer support.
- Practical software supply chain security experience, including dependency policies, software composition analysis, npm, artifact integrity, and CI/CD.
- Experience running bug bounty and penetration testing programs and managing external providers.
- Working knowledge of EVM smart contract security, common vulnerabilities, review methods, upgrade and admin controls, and external audit assessment.
- Demonstrated ability to deliver security improvements through engineering teams outside the reporting line and communicate risk clearly to technical and executive audiences.
- Preferred qualifications include OSCP, OSWE, or OSWA credentials; bug bounty or CTF experience; browser extension or mobile application security; AI workflow or production AI security; crypto, Web3, fintech, payments, or infrastructure experience; applied cryptography; state-actor and DPRK supply chain threat knowledge; and SOC 2 or ISO 27001 assurance experience.
Benefits
- Remote-first and remote-friendly global work environment.
- Applicants based in France, Italy, or Germany cannot be considered for this role.
- Employment may require background and identity verification checks, including employment, education, and criminal record checks.
Tech Stack
Categories
About Consensys
Consensys builds Web3 software for the Ethereum ecosystem, including the MetaMask wallet, Infura developer infrastructure, and the Linea zkEVM network. It monetizes through SaaS and enterprise offerings for developers, institutions, and businesses, plus staking and transaction services. Founded in 2014 by Ethereum co‑founder Joseph Lubin, the company is privately held and remote-first, serving tens of millions of users and thousands of developers.