Hexens.io is looking for a Senior Information Security Engineer with a strong focus on application security to join our team. At Hexens.io, we deliver cutting-edge cybersecurity services with a core emphasis on blockchain technology. We address complex security challenges, protecting applications and infrastructures that handle multimillion-dollar digital assets.
Remote Availability: Work from anywhere! This is a fully remote role with no location restrictions.
Responsibilities:
- Alongside our off-chain security lead, plan and deliver advanced application security assessments against API services, application front-ends, wallet software, browser plugins, mobile apps, and SDKs.
- Collaborate with leading smart contract auditors and cryptography researchers, leveraging your application security expertise to assess attack surfaces outside their on-chain specializations.
- Work to identify technical vulnerabilities, architectural flaws, and ways to mitigate future risk in the crucial junctions between off-chain and on-chain systems.
- Interact with developers and key stakeholders when identifying and handling security issues.
- Deliver clear and concise reporting on issues and attack paths identified.
Required skillset:
- At least 5 years experience, or equivalent technical expertise, delivering offensive security services, with a primary focus on application security.
- Expert-level web application and API security experience, with proficiency assessing apps with modern web frameworks, and identifying advanced client-side, back-end, and business logic attacks.
- Experience assessing mobile applications (Android/iOS), browser extensions, and desktop applications.
- Practical experience finding complex vulnerabilities and attack paths in Golang, Rust, TS/JS, Python, Java, or C-based codebases during white/grey-box appsec assessments.
- Working knowledge of cloud, CI/CD, container, CDN, and network security concepts, and how they apply to application security.
- Knowledge or willingness to learn web3 security concepts and how they apply to web3-centric applications.
- Decent scripting and automation skills.
- Assisting with scoping requirements for application security work.
- Strong client-facing and soft skills.
Big plus if any of the following apply:
- Significant web2 bug bounty/vulnerability disclosure history.
- Prior experience as a smart contract auditor or onchain-focused security researcher.
- Prior experience developing or integrating DeFi protocols, smart contracts, wallet services, or other web3 services.
- Advanced relevant security certifications (OSWE, Burp Suite Certified Professional, etc.)
Benefits:
- Work alongside industry-leading specialists
- Opportunity to work with the most exciting and prominent companies in the industry
- Highly competitive salary
- Great work environment
Skills Required
- At least 5 years of experience, or equivalent technical expertise, delivering offensive security services focused on application security.
- Expert-level web application and API security experience, including modern web frameworks and advanced client-side, back-end, and business logic attacks.
- Experience assessing Android and iOS mobile applications, browser extensions, and desktop applications.
- Practical experience finding complex vulnerabilities in Golang, Rust, TypeScript/JavaScript, Python, Java, or C codebases during white-box or grey-box assessments.
- Working knowledge of cloud, CI/CD, container, CDN, and network security concepts.
- Knowledge of, or willingness to learn, Web3 security concepts.
- Scripting and automation skills.
- Experience assisting with application security scoping requirements.
- Strong client-facing and interpersonal skills.
- Significant Web2 bug bounty or vulnerability disclosure history.
- Prior smart contract auditing or on-chain security research experience.
- Experience developing or integrating DeFi protocols, smart contracts, wallet services, or other Web3 services.
- Advanced security certification such as OSWE or Burp Suite Certified Professional.
What We Do
Hexens is a cybersecurity company that strives to elevate the standards of security in Web 3.0, create a safer environment for users, and ensure mass Web 3.0 adoption. Hexens has multiple top-notch auditing teams specialized in different fields of information security, showing extreme performance in the most challenging and technically complex tasks, including but not limited to: Infrastructure Audits, Zero Knowledge Proofs / Novel Cryptography, DeFi and NFTs. Hexens not only uses widely known methodologies and flows, but focuses on discovering and introducing new ones on a day-to-day basis.
Why Work With Us
Since Hexens was founded in 2021, it has had an impressive track record and recognition: Mudit Gupta - CISO of Polygon Technology - the biggest EVM Ecosystem, joined the company advisory board after completing just a single cooperation iteration. Polygon Technology, Mantle, Eigen Layer, 1inch, Lido, Hats Finance, Quickswap, Layerswap and many more
Gallery
