Protocol Security Engineer, Matter Labs

• It is a hands-on individual contributor role for someone who wants to know how things break and applies that instinct ethically where the stakes are high
• A record in security engineering or security research: threat modeling, security-focused code review, or vulnerability research on production systems, with findings you can walk through mechanism by mechanism
• Proficiency in strongly typed languages such as C++, Go, or Scala. Rust and Solidity are our primary languages, and prior experience with them is not required
• Deep grounding in algorithms and data structures, including their computational and memory complexity, with experience implementing them from scratch
• Protocol-level debugging and root-cause analysis on complex distributed systems
• Working knowledge of recent security incidents in the blockchain space and the prevention techniques behind them
• Clear written and spoken English, the company's working language
• If you meet most of these and believe you can do this job, apply anyway

Desirable

• You will protect ZKsync's core: smart contracts, ZK circuits, and blockchain nodes
• Your reviews, threat models, and incident work decide whether vulnerabilities are found by us or by attackers
• The role owns internal security reviews of critical components, threat modeling, adversary research, and the security side of incident response, and it carries broad license to spot gaps and fix them beyond any assigned list
• Break things on purpose. Threat-model and review Solidity contracts, blockchain state transition functions in Rust, and other critical systems before an attacker gets the chance
• Own protocol components. Take responsibility for the secure architecture and implementation of the components you adopt, from design review through production
• Track the adversary. Follow hacks, exploits, and new attack vectors across the industry and convert the lessons into concrete improvements in our systems
• Scale security through others. Embed secure-design practice across development teams and influence architecture decisions early, without formal authority
• Use AI on defense. Apply modern AI systems to scale security work, while accounting for attackers using the same tools
• Respond when it counts. Join security investigations and incident response, often under time pressure with incomplete information