[Hiring] Blockchain Security Researcher @OpenZeppelin

Role Description

OpenZeppelin's Security Services team is responsible for the security of the world's leading web3 protocols and top financial institutions building onchain. Our researchers partner with client teams across the full lifecycle of a protocol:

• Working on architecture and design before any code is written.
• Co-creating novel mechanisms and primitives with engineering teams.
• Conducting deep audits of pre-launch codebases.
• Providing continuous coverage as production systems evolve.

What you'll be doing:

• Review smart contracts for top decentralized applications, blockchain infrastructure, and financial institutions before they launch.
• Find vulnerabilities, prioritize them, and present findings to the client.
• Drive audits independently from start to finish, with AI as your primary collaborator.
• Partner with another researcher to attack the code together and pressure-test findings when useful.
• Partner with client teams during the design phase of new protocols, analyzing architecture, trust assumptions, and operational constraints before any code is written.
• Design and help develop smart contracts as part of co-creative engagements with protocol teams.
• Use AI efficiently throughout the audit process, building skills, agents, and workflows that compound across the team.
• Conduct open-ended research into cutting-edge blockchain technologies, vulnerability classes, and emerging attack vectors.
• Contribute findings back to OpenZeppelin's internal knowledge base and to the broader ecosystem.

Qualifications

• Hands-on and practical experience in one or more of the following: software development, cybersecurity, applied mathematics, distributed systems, cryptography, cryptoeconomics or game theory, or DeFi mechanisms.
• Experience designing and developing smart contracts, not only auditing them.
• Strong working knowledge of Solidity and the broader Ethereum / EVM ecosystem (common libraries, frameworks, smart contract patterns).
• Modern AI tooling is central to how you work, not a novelty.
• Comfort building and extending your own tooling (skills, agents, prompts, scripts, or full workflows).
• An advanced English level and strong communication skills (oral and written).

Requirements

• Experience with non-EVM ecosystems and languages, such as Canton, Move (Sui, Aptos), Golang (Cosmos SDK), Cairo (Starknet), Rust-based blockchains (Solana, Stellar), or ZK circuits and cryptography-heavy systems.
• Experience with risk assessment work in the crypto industry (smart contract risk assessment, threat modeling).
• Web2 security expertise (penetration testing, web application security, infrastructure security, or appsec).
• Experience with formal verification, invariant testing, or advanced fuzzing tools (Echidna, Foundry, Halmos, Certora).
• A track record in audit contests (Code4rena, Sherlock, Cantina) or bug bounty platforms (Immunefi, HackerOne).
• Public security research output, such as published findings, blog posts, conference talks, or contributions to open-source security tooling.

Benefits

• Meet your teammates at company gatherings around the world 😎
• Enjoy the flexibility of fully remote work 🌎
• Take the time you need with flexible time off 🏝
• Grow your family with 8 weeks of paid leave for primary caregivers, 4 weeks for secondary caregivers, and a one-time $3,600 baby bonus 💙
• Build your ideal home office with up to $500 in equipment support 🪑
• Stay covered with medical insurance 🏥
• Keep growing with learning and development opportunities 🧠
• Get a monthly stipend for your preferred co-working space 💻