almost 5 years ago
Remote, United StatesSenior
Base Salary
$100k - $180k/yr
Responsibilities
- Perform security assessments on web, mobile, thick-client, and browser-extension applications.
- Conduct external and internal network penetration tests.
- Perform security source-code reviews and cloud security reviews.
- Prepare comprehensive penetration-testing reports for technical and non-technical audiences.
- Research and develop innovative pentesting techniques, tools, and methodologies for blockchain applications.
- Contribute tools, presentations, blog posts, research, and community content to blockchain security.
Requirements
- At least 4 years of experience in application security and penetration testing.
- Experience reviewing source code in multiple languages, with strong JavaScript and TypeScript knowledge.
- Experience with mobile application penetration testing.
- Familiarity with the security risks of AWS, Azure, and GCP.
- Programming experience with scripting languages such as Python and Bash.
- Solid understanding of cryptography.
- BS, MS, or PhD in Computer Science or Information Security.
- Strong spoken and written communication skills.
- Passion for cryptocurrency, DeFi, blockchain, and willingness to learn Web3 technologies such as smart contracts.
- Preferred experience with Web3 application pentesting, smart-contract security audits, browser-extension security, blockchain security communities, bug-bounty programs, and audit contests.
- OSCP, OSWE, OSCE, GWAPT, or comparable certification is preferred.
- Published security-related blog posts or presentations at security conferences or meetups are preferred.
Benefits
- Medical, vision, and dental insurance.
- 401(k) plan with company matching.
- Life and accidental death and dismemberment insurance.
- Health Savings Account with a high-deductible plan and Flexible Spending Account.
- Flexible paid time off and holidays.
- Full-time position with a remote designation indicated by the posting.
Tech Stack
Categories
About CertiK
CertiK provides blockchain security products and services for Web3 teams, including smart-contract auditing, formal verification, and continuous on-chain monitoring (Skynet). It monetizes through audits, monitoring subscriptions, and related security engagements for protocols, exchanges, and infrastructure providers. Founded in 2018 and headquartered in New York, the privately held company is known for bringing academic formal methods to production smart contracts.