Money is moving onto the internet, and the shift has a name: with 100M+ downloads, users in ~190 countries, and trillions in cumulative transaction volume, it's the most trusted self-custodial financial platform on the internet. Join a remote-first, integral team rebuilding how money works: a problem that touches everyone, every day. Blockchain transactions are generally irreversible, meaning a vulnerability in the product or its software delivery chain can lead directly to financial losses for users. We are looking for a Senior Manager, Application Security to lead application security across the MetaMask extension, mobile app, Snaps, backend services, DeFi primitives, stablecoins, and supporting smart contracts. The role covers architecture, code, dependencies, build and release controls, security testing, and vulnerability disclosure. You will set the strategy and operating model, lead a small senior team, and remain directly involved in code review and threat modelling. You will report to the Head of Security and work closely with MetaMask Engineering leadership to ensure security risks are understood, owned, and addressed. Leadership and planning Lead and develop the Application Security team, including hiring, performance management and career development, while remaining directly involved in technical work. Set the Application Security strategy, annual goals and quarterly OKRs in line with company objectives and the approved Target Operating Model. Define and track KPIs to measure performance and progress. Report AppSec progress, coverage, remediation performance and material gaps to Security leadership and contribute to Risk Committee reporting. Define security review requirements across development and release, assess whether they are met and escalate unresolved risks.



Lead threat modelling and security design reviews across clients, APIs and backend services, including authentication, key management, signing and delegated actions. Define software supply chain security requirements and work with engineering teams to implement and validate controls for dependencies, builds, artefacts and publishing. Lead security code reviews across MetaMask applications and smart contracts, working with engineers and relevant specialists to address findings. Set security standards for AI development tools, generated code and AI components in products. Integrate security testing into development and delivery workflows, including static and dynamic analysis, dependency scanning, secrets detection and AI scanning. Help engineers prevent recurring vulnerabilities through secure coding guidance, reusable libraries, training and the security champions programme. Vulnerability management and external testing Set the scope and proposed investment for bug bounty, penetration testing and AI security scanning based on risk and results. Provide evidence of application security controls for audits and assurance reviews, and support customer and partner due diligence. Provide application security expertise during incidents, including vulnerability analysis and remediation support. At least eight years in application security or software engineering with a security focus, including two years leading people.



Strong practical code review skills in TypeScript/JavaScript, Go or Solidity across browser extensions, mobile applications and backend services, with the ability to identify vulnerabilities and work with engineers to fix them. Proven experience securing applications across clients and backend services, including distributed authentication, authorisation and key management. Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management and developer support, with sound judgement on where AI adds value and how to validate its findings. Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity and CI/CD. Experience running bug bounty and penetration testing programmes, including selecting and managing external providers. Working knowledge of EVM smart contract security, including common vulnerabilities, review methods, upgrade and admin controls, and assessing external audits. A record of delivering security improvements through engineering teams outside your reporting line. Offensive security qualifications such as OSCP, OSWE or OSWA, or a proven record in bug bounty programmes or CTF competitions. Familiarity with attacks by state actors against software companies, particularly DPRK supply chain and social engineering campaigns. We’re passionate about building a diverse team of humans and as such, if you think you've got what it takes for our chaotic-but-fun, remote-friendly, start-up environment—apply anyway, detailing your relevant transferable skills in your cover letter. While we have a pretty good ide

📌 Senior System Security Manager (España)
🏢 Consensys
📍 España