Security Chain Engineer (Injective Labs)

We are looking for an accomplished Chain Engineer with a security focus to join our existing highly-skilled global protocol team. You will build and harden the core of the Injective chain, making sure every module, upgrade and integration is safe before it reaches mainnet. You'll work alongside protocol engineers from spec to release, reviewing designs for attack vectors, auditing native chain code and EVM contracts, and building the tooling that keeps the chain secure over time. We're looking for someone who can work autonomously, has a hacker mentality, and thinks like an attacker while building like an engineer.

If you're an autonomous engineer with a strong security mindset who enjoys working with a high degree of ownership, and you're looking to protect and strengthen the financial infrastructure of one of the fastest growing blockchains, this role is for you.

• Execute internal security audits of Injective's Cosmos-SDK modules, including the decentralized orderbook, trade execution coordinator, order matcher, and Layer-2 execution environment
• Review and audit EVM smart contracts, EVM integrations, and cross-chain bridge and IBC components
• Partner with senior protocol engineers to build security into new chain features from day one, threat-modeling both technical and economic risks (e.g. oracle manipulation, MEV, liquidation and market-manipulation attacks)
• Build, maintain, and test hardened core components of the chain (consensus, state management, financial infrastructure), and fix vulnerabilities directly in the codebase
• Develop security tooling such as fuzzers, invariant and property-based tests, static analysis, and on-chain monitoring and alerting
• Review chain upgrades and pull requests with a focus on determinism, consensus safety, denial-of-service vectors, and state-machine correctness
• Write clear, high-quality security reports, both internal and public, and coordinate with external auditors, bug bounty researchers, and partners on findings and disclosure
• Take part in incident response, and drive post-mortems and remediation when issues arise
• Research and track the latest blockchain exploits and security developments, and share learnings with the wider team

• Minimum of 3 years' experience as a Blockchain Engineer, with a significant focus on security
• 5+ years of experience in software security
• Hands-on experience auditing (internally or externally) DeFi protocols or blockchain core code, with findings you can speak to
• Solid understanding and proficiency of Golang and/or Solidity
• Strong knowledge of Go idioms, libraries, and parallel processing, plus the security pitfalls common in Go and Cosmos-SDK chains (non-determinism, panics, unbounded iteration, gas and DoS issues)
• Strong knowledge of blockchain, DeFi & DEX concepts, consensus mechanisms, CosmWasm contract platform
• Solid understanding of cryptography primitives, including digital signatures and the hash algorithms used by Ethereum and Cosmos
• Ability to write clear security reports and explain risk to both technical and non-technical team members

• A track record in bug bounties, CTFs, or published audits and CVEs
• Experience with fuzzing and formal verification tools
• Prior experience working in trading or at an exchange
• Knowledge of financial instruments and markets

WHY WORK WITH US?

• Competitive salary and INJ token award
• Remote-friendly work environment with flexible hours.
• Unlimited PTO
• Equipment
• Home Office Stipend
• Opportunity to work on cutting-edge blockchain technology in the finance industry.
• Collaborative team culture with opportunities for professional growth and development
• Global team meetups

To apply for this position, please submit your application through the following link:

https://injectivelabs.org/careers/?ashby_jid=76a5a4dc-b3e5-42ed-94b3-55acc478cc5c#open-roles

Only applications submitted through this link will be considered.

We will only contact candidates using emails from the @injective.foundation http://injective.foundation domain. If you are approached by any other account or domain regarding this position, it was not sent by us. Please stay cautious and report any suspicious communication.