Senior Manager, Application Security
Core
Lead application security for MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and smart contracts, focusing on architecture, code, dependencies, and vulnerability management.
Role type
Senior Manager, Application Security (hands-on IC with leadership)
Builds
MetaMask self-custodial financial platform (extension, mobile, backend, smart contracts)
Domain
Web3 / Crypto / Fintech
Required skills
Application security strategy, TypeScript/JavaScript/Go/Solidity code review, software supply chain security, bug bounty management, smart contract security, secure development lifecycle design, threat modelling, vulnerability triage
Preferred skills
Offensive security certifications (OSCP/OSWE/OSWA), browser extension/mobile app security, AI security in development workflows, applied cryptography, state-actor attack experience
Technologies
TypeScript, JavaScript, Go, Solidity, EVM, npm, CI/CD, static/dynamic analysis tools
Responsibilities
Lead and develop the AppSec team (hiring, performance, career); set security strategy and OKRs; conduct security code reviews and threat modelling; define supply chain security controls; manage vulnerability assessment and remediation; oversee bug bounty and penetration testing programs; integrate security testing into DevOps workflows; support incident response and audits
Seniority
Senior, hands-on IC with people leadership