Staff/Senior Security Engineer - DeFi

About the role

This role focuses on securing the operational infrastructure for Ethena Labs' digital dollar products, which include USDe, iUSDe, and USDtb. The successful candidate will be responsible for the end-to-end design and evolution of the company's signing regime, including signer composition, thresholds, and pre-signature verification workflows. This involves ensuring the integrity of destination, calldata, and state-change confirmations before any transaction is finalized.

A key part of the position involves managing and upgrading the canonical address and contract allowlist system. This includes ensuring all whitelisting and approval actions are checked against this list and that any additions undergo documented review. The engineer will also operate and refine real-time monitoring across wallets, custodians, and DeFi positions, integrating these systems with SOC 2 incident-response workflows and contributing to playbooks for emerging risk scenarios.

Success in this role means maintaining a robust security posture for Ethena Labs' financial products. This includes conducting independent technical reviews of new protocol integrations, keeping the risk register current, and verifying ERC-20 approval hygiene across the treasury. The engineer will also partner with the Finance team on automated reconciliation between on-chain activity and accounting systems, and produce high-quality documentation for auditors and institutional counterparties.

The listed salary range for this Staff/Senior Security Engineer position is $112,000 to $188,000 USD.

Skills that matter here

• Solidity: The role requires mastery of Solidity and EVM to read arbitrary contracts and raw calldata without assistance.
• EVM: Fluency in EVM is necessary for using tools like Tenderly, Foundry-based simulation, and trace analysis.
• Gnosis Safe: Practical experience with Gnosis Safe is required, along with an understanding of its operational failure modes.
• Coinbase Prime: Deep practical experience with Coinbase Prime is expected, including knowledge of its browser-based custodian extensions.
• DeFi protocols: The role demands strong practitioner-level knowledge of DeFi protocols to understand risk parameters, oracle structures, and bridge message-passing mechanics.
• Aave: Understanding of specific DeFi protocols like Aave is important for assessing risk and integration.

Who this role suits

• You are a security-minded individual who operates with a default assumption of a hostile environment.
• You are energized by rigorous verification and committed to maintaining high safety standards under operational pressure.
• You can clearly articulate complex technical risks to non-technical stakeholders, including executives and auditors.
• You are a self-starter comfortable taking full ownership of infrastructure and producing audit-grade documentation.

From the employer

What You’ll Do:

• Own the end-to-end design of our signing regime, including signer composition, thresholds, and intent communication, and continue evolving our pre-signature verification workflows for destination, calldata, and state-change confirmation.
• Manage, maintain and continuously upgrade canonical address and contract allowlist system and infra that manages it, ensuring every whitelisting or approval action is checked against this list pre-signature, requiring documented review for any additions.
• Operate and tighten real-time monitoring across wallets, custodians, and DeFi positions, keep it integrated with our SOC 2 incident-response workflows, and contribute to playbooks for evolving risk scenarios.
• Run independent technical reviews of new protocol integrations and keep our risk register current as positions and dependencies evolve.
• Continuously verify ERC-20 approval hygiene across the treasury, and partner with Finance on automated reconciliation between on-chain activity and accounting systems.
• Own the process of producing the documentation of controls, tooling, and decisions that our auditors, underwriters, and institutional counterparties expect.

What We’re Looking For:

• Mastery of Solidity and the EVM; you can read arbitrary contracts and raw calldata without assistance. You are fluent in tools such as Tenderly, Foundry-based simulation, and trace analysis.
• Deep practical experience with Gnosis Safe, Coinbase Prime, Anchorage, and Fireblocks. Strong understanding of the operational failure modes inherent in browser-based custodian extensions and hardware wallet signing flows.
• Strong practitioner-level knowledge of DeFi protocols like Aave, Morpho, and Stargate. You understand risk parameters, oracle structures, and bridge message-passing mechanics.
• A security-first mindset that assumes a hostile environment by default. You possess a "vigilance disposition" - you are energized by rigorous verification and are committed to maintaining safety standards even when facing operational pressure.
• Proven ability to explain technical risks to non-technical stakeholders (COO team, executives, auditors). You are a self-starter comfortable owning infrastructure end-to-end and producing high-quality, audit-grade documentation.

Why Ethena Labs?

• You'd be joining a group that has well established itself as one of the most successful crypto-native company's of all time, a group with a mission to revolutionise decentralised finance and it's position in global finance.
• Work alongside a passionate and innovative team that values collaboration and creativity.
• Enjoy a flexible, remote-friendly work environment with established opportunities for personal growth and learning.