Senior Application Security Engineer
The full posting
ABOUT THE ROLE
As anApplication Security Engineerat RootstockLabs, you will help secure our Bitcoin-secured DeFi infrastructure by reviewing code, smart contracts, and protocol changes, and by building the security automation that keeps our development lifecycle safe. You will work closely with development teams on threat modeling and architecture reviews, manage our bug bounty program end to end, and coordinate external security audits with third-party auditors. You will also research attack techniques relevant to our ecosystem (EVM, bridges, p2p) and translate them into concrete defenses, and support incident investigations when application-layer issues arise.
KEY RESPONSIBILITIES
- Perform security reviews of source code, smart contracts, and protocol changes across RootstockLabs projects
- Participate in design and architecture reviews; threat-model new products and features with development teams
- Triage and validate bug bounty reports; assess severity and coordinate remediation with engineering
- Collaborate on external security audits: scope engagements and work with third-party auditors through to the resolution of findings
- Build and operate security automation, including AI-assisted code review, scanning, and findings-triage pipelines
- Research attack techniques relevant to the ecosystem (EVM, bridges, p2p) and turn findings into concrete defenses: monitoring alerts, CI security checks, and hardening changes
- Support incident investigations when application-layer issues arise
WHAT YOU BRING
- 3+ years of experience in Application Security or Security Engineering
- Solid grasp of common vulnerability classes (OWASP Top 10) and secure code review in Java plus at least one of TypeScript/JavaScript, Python, Go, or Rust
- Hands-on experience with blockchain security: smart contract auditing (Solidity/EVM) or protocol/node-level security
- Experience building and operating security automation, AI-assisted workflows (LLM-based triage, code review, or scanning), SAST/DAST, dependency and secret scanning, and CI/CD security gates
- Fluent English
NICE TO HAVE
- Experience in bug bounty triage or vulnerability disclosure programs
- Experience mitigating network-level attacks (p2p, eclipse, DoS) or analyzing consensus-level attack scenarios
- Offensive security background (pentesting, red team, CTFs, exploit development)
- Public security research: CVEs, bug bounty track record, audit reports, conference talks
- Knowledge of C/C++ (for node/client codebases)
- Experience with fuzzing (smart contracts or native code)
ROOTIES BENEFITS
At RootstockLabs, we don’t just offer a job, we offer a community. Here’s what you can expect when you join us:
- Competitive compensation package and unique benefits designed to support your growth and well-being.
- 100% Remote Work working within a Central European to Argentinian time-zone window (UTC-3 to UTC+2, with about an hour's flexibility either side), and with access to global coworking spaces.
- Work-Life Balance: Paid vacation and sick leave days
- Continuous Learning: Access to training programs, language courses, and learning sponsorship annually.
- Unique Projects: Work with cutting-edge blockchain technology in a global, diverse team.
ABOUT ROOTSTOCKLABS
RootstockLabs is a key contributor to Rootstock, Bitcoin's Financial Infrastructure for lending, yield, and onchain capital markets. We build and commercialize the institutional infrastructure that turns Bitcoin into productive capital.
- What we do: Develop and commercialize Bitcoin-backed lending, tokenized real-world assets, and onchain financial strategies
- Who we work with: Leading custodians, asset managers, and financial institutions
- Why it matters: Rootstock is secured by 80%+ of Bitcoin's hash power and has run with 100% uptime since 2018 (bringing Ethereum-style programmability to the world's hardest money).
- Proof it works: 200+ dApps live on Rootstock, from BTCFi protocols like Sushiswap and Oku to institutional names like Mercado Bitcoin, Animoca Brands, and Paystand
Where you can be based
This position is 100% remote and open to applicants anywhere in the world.
Text as RootstockLabs published it; last compared with the original on 13 Nov 2026.
The application
Your details, CV, LinkedIn and GitHub, then 7 questions (1 written).
- 1.RegionChoose one
- 2.How many years of hands-on professional experience do you have in application security or security engineering?Choose one: 0-2 years · 2-3 years · 3-5 years · 5-7 years · 7+ years
- 3.How many years have you worked in the crypto or blockchain space? For example blockchain security, smart contract security, or security work at a crypto company?Choose one: None · Less than 1 year · 1-2 years · 2-4 years · 4-6 years · 6+ years
- 4.Which languages can you confidently read and review for security issues? Select all that applyChoose any (11 choices)
- 5.Which of the following best describes your hands-on security experience? Select all that apply.Choose any
- 6.Do any of the following apply to you? Select all that apply.Choose any (9 choices)
- 7.Do you use AI? How do you currently use AI tools in your day-to-day security work? Which tools, and for what kinds of tasks?Written answer
Taken from RootstockLabs's application form as it stood on 13 Nov 2026.
The employer: RootstockLabs
Builds lending, payment and bridging products on the Rootstock Bitcoin sidechain; it seeks a Senior Application Security Engineer to work remotely.
Pay and benefits: Remote staff role on a team spread across many countries.
Other security roles worth a look
A few links on CyberJobs.cc are referral links: when one leads to a hire, a sign-up or a purchase (a lab, a course or a tool marked Partner), the company behind it may pay CyberJobs.cc a fee. You pay nothing extra, and it never changes the salary an employer offers you or which roles the board lists. Roles from partners who pay us a fee rank a little higher in this list.
Cybersecurity Engineer (shows the role here)
Inetum · Security Engineering · Lisbon, Lisbon, Portugal· 1mo agoDetails
Backend Security Engineer (shows the role here)
micro1 · Security Engineering · Remote· 1mo agoDetails
$30–$100/hr
Let security teams come to you
Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.
Hear first when RootstockLabs posts a security role
We read RootstockLabs's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.