Senior Manager, Application Security
New
M
MetaMaskWeb3, blockchain
EMEA - RemoteFull-TimeManager
Salary not disclosed
Apply NowOpens the employer's application page
Job Details
- Experience
- At least eight years in application security or software engineering with a security focus, including two years leading people.
- Required Skills
- JavascriptTypeScriptGoCI/CD
Requirements
- At least eight years in application security or software engineering with a security focus.
- At least two years leading people.
- Strong practical code review skills in TypeScript/JavaScript, Go, or Solidity across browser extensions, mobile applications, and backend services.
- Experience securing applications across clients and backend services, including distributed authentication, authorisation, and key management.
- Experience building or substantially improving an AppSec programme, including security reviews, automated testing, AI scanning, vulnerability management, and developer support.
- Practical experience securing software supply chains, including dependency policies, software composition analysis, npm, artefact integrity, and CI/CD.
- Experience running bug bounty and penetration testing programmes, including selecting and managing external providers.
- Working knowledge of EVM smart contract security, including common vulnerabilities, review methods, upgrade and admin controls, and assessing external audits.
- A record of delivering security improvements through engineering teams outside your reporting line.
- Clear written communication, including actionable threat models and concise executive risk summaries.
- Preferred: offensive security qualifications such as OSCP, OSWE, or OSWA, or a proven record in bug bounty programmes or CTF competitions.
- Preferred: experience securing browser extensions or mobile applications, AI-enabled development workflows, or AI components in production applications.
Responsibilities
- Lead and develop the Application Security team, including hiring, performance management, and career development.
- Set the Application Security strategy, annual goals, quarterly OKRs, and KPIs.
- Report AppSec progress, coverage, remediation performance, and material gaps to Security leadership.
- Define and assess security review requirements across development and release, escalating unresolved risks.
- Lead threat modelling and security design reviews across clients, APIs, and backend services.
- Define software supply chain security requirements and work with engineering teams to implement and validate controls.
- Lead security code reviews across MetaMask applications and smart contracts.
- Evolve the secure development lifecycle for AI agents, AI development tools, generated code, and AI components in products.
- Integrate and evaluate security testing in development and delivery workflows, including static and dynamic analysis, dependency scanning, secrets detection, and AI scanning.
- Own vulnerability assessment, triage, prioritisation, remediation tracking, bug bounty, penetration testing, and vulnerability disclosure.
- Provide application security evidence for audits and assurance reviews, and support customer and partner due diligence.
- Provide application security expertise during incidents, including vulnerability analysis and remediation support.
View Full Description & ApplyYou'll be redirected to the employer's site
