Protocol Security Engineer

About Matter Labs

Matter Labs develops private settlement infrastructure enabling regulated institutions to perform direct settlements without revealing data, relinquishing control, or enduring multi-day waits. Traditional finance channels handle $4 quadrillion annually using outdated systems built on paper and telegraph technologies. Institutions, ranging from clearing houses to major banks, are transitioning to modern platforms. Their flagship product, Prividium, provides isolated private settlement zones with independent governance and ensures interoperability across counterparties, asset classes, and jurisdictions. Settlement is secured through zero-knowledge proofs, allowing validation without exposing sensitive transaction details—uniquely positioned as the only private settlement infrastructure leveraging zero-knowledge cryptography. Founded in 2018 and supported by investors such as a16z and Union Square Ventures, the company operates a fully remote team of approximately 70 experts dedicated to pioneering zero-knowledge infrastructure.

Role Overview

As a Protocol Security Engineer, you will safeguard the core assets of ZKsync including smart contracts, zero-knowledge circuits, and blockchain nodes. Your thorough audits, threat modeling, and incident involvement will determine if vulnerabilities are uncovered internally or exploited by adversaries. You will lead security assessments of critical components, conduct adversary research, and manage security aspects of incident response, having the initiative to identify and remedy security gaps even beyond assigned tasks. This is a hands-on role for someone passionate about discovering system weaknesses and protecting high-stakes environments.

Key Responsibilities

• Proactively identify vulnerabilities by carefully threat modeling and reviewing Solidity smart contracts, Rust blockchain state transition functions, and other vital systems before attackers can exploit them.
• Take ownership of protocol components, overseeing secure design and implementation from feasibility assessment through to production deployment.
• Monitor the security landscape by tracking hacks, exploits, and emerging attack methods, translating insights into concrete system enhancements.
• Amplify security awareness by embedding secure design principles within development teams and influencing architectural decisions at early stages without relying on formal authority.
• Leverage AI technologies to enhance defensive measures while remaining mindful of adversarial use of the same tools.
• Engage actively in security investigations and respond swiftly to incidents amidst uncertain and time-pressured conditions.

Desired Qualifications

• Proven experience in security engineering or research, including threat modeling, security-focused code auditing, or vulnerability research on live systems, with an ability to explain findings comprehensively.
• Competence in statically typed programming languages such as C++, Go, or Scala; prior experience with Rust and Solidity is advantageous but not mandatory.
• Strong foundation in algorithms and data structures, particularly regarding computational efficiency and memory use, with practical implementation experience.
• Expertise in debugging protocols and performing root-cause analysis on intricate distributed systems.
• Familiarity with recent blockchain security incidents and corresponding mitigation techniques.
• Excellent written and verbal communication skills in English, the company's primary language.

Preferable Extras

• Hands-on experience with Solidity smart contracts, zero-knowledge circuits, or fundamental blockchain protocols.
• Demonstrable public security research, audit contributions, bug bounty accomplishments, or capture-the-flag (CTF) competition records.

Work Environment and Compensation

• Competitive salary structure with no geographic pay adjustments.
• Performance-based variable compensation with an established annual goal, paid in cash or ZK tokens.
• Long-term token incentives vesting over four years with a one-year cliff, rewarding sustained contribution.
• Fully remote work setup with occasional travel for team meetups and industry conferences.
• A culture emphasizing autonomy and ownership, with minimal bureaucracy and no mandatory time tracking where legally permissible.