Security Engineering Lead
Remote
Engineering – Infrastructure /
Full-time /
Remote
Espresso Systems is the lead developer of Espresso, supporting layer-2 rollups with scale, decentralization, and interoperability.
Rollups have enriched the greater Ethereum ecosystem with horizontal scalability and a diversity of execution environments, but at the expense of fragmentation—apps across rollups do not have the same shared liquidity and interoperability as apps on the Ethereum L1. Espresso is a shared sequencing marketplace for rollups to increase utility for their users through improved safety, liveness, and interoperability—while being compensated for the value they create and maintaining their autonomy.
Contributors to Espresso comprise a diverse team located around the world. We are passionate about building a better infrastructure for how we transact and interact online. We are builders, designers, researchers, and hackers and have contributed in academia, in open source communities, in policymaking, and beyond. We are backed by over $50m in funding from leading investors in technology and crypto including a16z, Greylock Partners, Electric Capital, Sequoia Capital, and Polychain Capital.
As a Security Engineering Lead on our team, you'll be leading the security and auditing efforts for Espresso's codebase leading up to, and beyond, launch. We are looking for an experienced security engineering and software auditing professional who can lead review processes of our design and codebase. Experience in the domains of EVM smart contracts and/or Rust distributed systems is preferred for this role.
Responsibilities
- Lead security audits of (a subset of) the Espresso codebase
- As a project leader, you will have mobility in how you choose to organize security and audit efforts
- Dive into the code of a fairly complex distributed system, learning and developing an understanding of the system on the fly (with help from the engineering team that built it, of course)
- Coordinate with several engineering teams to aid in your audit, raise concerns and communicate results, and guide the effort to harden the system based on your findings
- Coordinate with, manage, and review the work of external security auditing teams, in certain cases
- Suggest improvements to testing and engineering practices to promote more secure and maintainable code
Requirements
- Solid grasp of software engineering principles, both low-level (e.g. language-specific best practices) and high-level (e.g. reliable software architecture, particularly in distributed systems)
- If focused on Rust: ≥ 1 year experience writing Rust, particularly with async Rust.
- If focused on Solidity: Multiple years experience writing smart contracts; experience with smart contract security audits or formal verification of smart contracts
- Experience as an engineer or software architect in a security-critical industry
- Be capable of describing the stakes, the challenges you've faced in building secure software, and the steps/processes you've taken to mitigate risk
- Experience as an auditor, pentester, QA tester, etc.
- Have a well thought-out approach to testing software and designing it to be testable/auditable
- Ability to think adversarially, and identify potential reliability or security vulnerabilities even in software that is correct in common or “happy path” scenarios
- Experience on the design and/or testing of distributed systems
- Comfort diving into unknowns and asking questions
Preferred
- Knowledge of relevant testing and static analysis tools (e.g. Foundry, Slither) is a plus
- Blockchain knowledge/experience is preferred, but could also be include IoT, automotive, finance, etc.
- Ideally, the candidate should have a general philosophy of software design that has been molded by experience working on security-critical systems
Benefits
- Fully remote with flexible hours
- Work alongside the brightest minds in the crypto space
- Competitive salary + equity package
- Regular team off-sites to international locations
- Unlimited vacation policy
- Top-tier health, dental, and vision coverage for US employees
