Blockchain Protocol Security Engineer at MatterLabs

About Matter Labs

Matter Labs is at the forefront of building private settlement infrastructure for regulated institutions, allowing direct, secure settlement without exposing sensitive data, ceding control, or enduring lengthy wait times. The global financial system, handling quadrillions annually, still relies on antiquated systems, which institutions are actively modernizing. Our flagship product, Prividium, offers each institution its own secure, private settlement environment - a Prividium Zone - complete with independent governance and built-in interoperability across various counterparties, asset classes, and jurisdictions. Settlement is powered by zero-knowledge proofs, enabling one party to validate a transaction without revealing any underlying data to the counterparty. We are the only private settlement infrastructure leveraging zero-knowledge cryptography. Founded in 2018 and backed by prominent investors like a16z and Union Square Ventures, Matter Labs operates as a fully remote team of approximately 70 experts, boasting eight years of production-grade zero-knowledge infrastructure experience, now directed at solving the biggest challenges in institutional finance.

The Role

As a Protocol Security Engineer, you will play a critical role in safeguarding ZKsync's core components, including smart contracts, ZK circuits, and blockchain nodes. Your expertise in security reviews, threat modeling, and incident response will be crucial in identifying vulnerabilities before malicious actors can exploit them. This is a hands-on individual contributor position, granting broad license to identify and address security gaps beyond assigned tasks. It is ideal for someone driven by a desire to understand how systems break and apply that knowledge ethically in high-stakes environments.

What You Will Do

• Proactively Identify Vulnerabilities: Conduct thorough threat modeling and security reviews of Solidity contracts, blockchain state transition functions written in Rust, and other critical systems to prevent potential attacks.
• Own Protocol Components: Take full responsibility for the secure architecture and implementation of adopted components, from initial design review through to production deployment.
• Track Adversary Tactics: Continuously monitor industry hacks, exploits, and emerging attack vectors, translating these lessons into concrete security improvements for our systems.
• Scale Security Practices: Champion secure design principles across development teams, influencing architectural decisions early in the process without relying on formal authority.
• Leverage AI for Defense: Apply advanced AI systems to enhance and scale security operations, while also considering how attackers might utilize similar tools.
• Lead Incident Response: Participate in security investigations and incident response, often under significant time pressure and with incomplete information.

What We Look For

Candidates should demonstrate proven capabilities in the following areas:

• Security Engineering Experience: A track record in security engineering or research, including threat modeling, security-focused code review, or vulnerability research on production systems, with the ability to detail findings mechanism by mechanism.
• Proficiency in Strongly Typed Languages: Competence in languages such as C++, Go, or Scala. Prior experience with Rust and Solidity, our primary languages, is beneficial but not mandatory.
• Deep Understanding of Algorithms and Data Structures: Strong foundational knowledge of algorithms and data structures, including their computational and memory complexity, with practical implementation experience.
• Protocol-Level Debugging: Ability to perform root-cause analysis and debugging on complex distributed systems at the protocol level.
• Blockchain Security Knowledge: Working knowledge of recent security incidents within the blockchain space and familiarity with relevant prevention techniques.
• Clear Communication: Excellent written and spoken English, as it is the company's working language.

If you meet most of these qualifications and believe you can excel in this role, we encourage you to apply.

Nice to Have

• Hands-on experience with Solidity smart contracts, ZK circuits, or core blockchain protocols.
• Evidence of public security research, audit reports, bug bounty results, or CTF history.

Work Model & Pay

• Competitive Compensation: We offer a competitive base salary with no geographic pay discounts.
• Variable Compensation: Additional performance-based variable compensation with a defined annual target, payable in ZK tokens or cash.
• Long-term Incentives: A long-term token incentive is also provided, paid in ZK tokens, with new hire grants vesting over four years with a one-year cliff.
• Fully Remote: This is a fully remote position, with occasional travel required for team gatherings and industry events.
• Freedom & Ownership Culture: We foster a culture emphasizing freedom and ownership, with no time tracking (where legally applicable) and minimal bureaucracy, focusing solely on results.