Security Engineering Lead

Espresso Systems builds foundational infrastructure to power tomorrow’s internet, where digital assets can move across chains seamlessly. As a Security Engineering Lead, you will oversee security audits and enhance the security of Espresso's codebase, collaborating with engineering teams and external auditors to ensure robust security practices.

Responsibilities:

• Lead security audits of (a subset of) the Espresso codebase
• As a project leader, you will have mobility in how you choose to organize security and audit efforts
• Dive into the code of a fairly complex distributed system, learning and developing an understanding of the system on the fly (with help from the engineering team that built it, of course)
• Coordinate with several engineering teams to aid in your audit, raise concerns and communicate results, and guide the effort to harden the system based on your findings
• Coordinate with, manage, and review the work of external security auditing teams, in certain cases
• Suggest improvements to testing and engineering practices to promote more secure and maintainable code

Requirements:

• Solid grasp of software engineering principles, both low-level (e.g. language-specific best practices) and high-level (e.g. reliable software architecture, particularly in distributed systems)
• If focused on Rust: ≥ 1 year experience writing Rust, particularly with async Rust
• If focused on Solidity: Multiple years experience writing smart contracts; experience with smart contract security audits or formal verification of smart contracts
• Experience as an engineer or software architect in a security-critical industry
• Be capable of describing the stakes, the challenges you've faced in building secure software, and the steps/processes you've taken to mitigate risk
• Experience as an auditor, pentester, QA tester, etc
• Have a well thought-out approach to testing software and designing it to be testable/auditable
• Ability to think adversarially, and identify potential reliability or security vulnerabilities even in software that is correct in common or 'happy path' scenarios
• Experience on the design and/or testing of distributed systems
• Comfort diving into unknowns and asking questions
• Knowledge of relevant testing and static analysis tools (e.g. Foundry, Slither) is a plus
• Blockchain knowledge/experience is preferred, but could also be include IoT, automotive, finance, etc
• Ideally, the candidate should have a general philosophy of software design that has been molded by experience working on security-critical systems