About the company
MetaMask is a self-custody wallet with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume. Join a remote-first, global team.
Responsibilities
- Lead and develop the Application Security team, including hiring, performance management and career development
- Set the Application Security strategy, annual goals and quarterly OKRs; define and track KPIs
- Define security review requirements across development and release
- Lead threat modelling and security design reviews across clients, APIs and backend services
- Define software supply chain security requirements and validate controls for dependencies, builds, artefacts and publishing
- Lead security code reviews across MetaMask applications and smart contracts
- Define and evolve the secure development lifecycle to incorporate AI agents
- Integrate security testing into development workflows: static and dynamic analysis, dependency scanning, secrets detection, AI scanning
- Own application vulnerability assessment, triage, prioritisation and remediation tracking
- Set scope and investment for bug bounty, penetration testing and AI security scanning
- Provide application security expertise during incidents
Requirements
- At least eight years in application security or software engineering with a security focus, including two years leading people
- Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services
- Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management
- Experience building or improving an AppSec programme including security reviews, automated testing, AI scanning, vulnerability management
- Practical experience securing software supply chains: dependency policies, software composition analysis, npm, artefact integrity and CI/CD
- Experience running bug bounty and penetration testing programmes
- Working knowledge of EVM smart contract security
Conditions
- Remote-first, global team
- Not able to consider candidates based in France, Italy, or Germany