[All remote jobs](https://jobicy.com/jobs.md)[![CertiK logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/03/Jobicy-210308091023-955845.jpg)](https://jobicy.com/company/certik.md)[CertiK](https://jobicy.com/company/certik.md) # Sr. Security Engineer (Penetration Testing) Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/certik.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 100k–180k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceOpen levelPublished27 Oct 2026Apply before26 Nov 2026Listing views73Application actions4Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. CertiK is hiring a senior security engineer to conduct penetration tests and application-security assessments across web, mobile, thick-client, cloud, network, and browser-extension environments. The role combines hands-on offensive security work, source-code review, threat modeling, reporting, and research into blockchain and Web3 security techniques. Candidates need at least four years of application-security and penetration-testing experience, strong JavaScript/TypeScript knowledge, scripting skills, and familiarity with AWS, Azure, and GCP risks. Web3 penetration testing, smart-contract audit experience, security certifications, bug-bounty participation, and community contributions are valuable differentiators. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThis is a senior offensive-security role requiring broad testing expertise across applications, mobile, networks, cloud, and code review, plus cryptography and emerging Web3 concepts. Client-facing reporting and security research add technical depth and accountability. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$140,000US market range (per year)$130k–$190k0$209.00k AI insightThe employer explicitly lists a US annual base-salary range of $100,000–$180,000, with a midpoint of $140,000 per year. Estimated US market compensation for a senior penetration-testing and application-security engineer with blockchain exposure is approximately $130,000–$190,000 annually; this is an AI estimate, not verified salary research. ## Core skills Skills and capabilities most closely associated with this opportunity. [Application security](https://jobicy.com/jobs?search_keywords=Application%20security.md)[Penetration testing](https://jobicy.com/jobs?search_keywords=Penetration%20testing.md)[Web application security](https://jobicy.com/jobs?search_keywords=Web%20application%20security.md)[Mobile application security](https://jobicy.com/jobs?search_keywords=Mobile%20application%20security.md)[Network penetration testing](https://jobicy.com/jobs?search_keywords=Network%20penetration%20testing.md)[Source code review](https://jobicy.com/jobs?search_keywords=Source%20code%20review.md)[Cloud security](https://jobicy.com/jobs?search_keywords=Cloud%20security.md)[Threat modeling](https://jobicy.com/jobs?search_keywords=Threat%20modeling.md)[JavaScript](https://jobicy.com/jobs?search_keywords=JavaScript.md)[TypeScript](https://jobicy.com/jobs?search_keywords=TypeScript.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Bash](https://jobicy.com/jobs?search_keywords=Bash.md)[Cryptography](https://jobicy.com/jobs?search_keywords=Cryptography.md)[AWS](https://jobicy.com/jobs?search_keywords=AWS.md)[Smart contract security](https://jobicy.com/jobs?search_keywords=Smart%20contract%20security.md) Sample interview questionsDescribe your methodology for performing a penetration test of a web application.I begin by defining scope, rules of engagement, assets, and testing windows. I map the attack surface through reconnaissance, authentication and authorization analysis, input validation testing, business-logic review, and infrastructure checks, then validate findings safely, assess impact, and deliver prioritized remediation guidance with clear reproduction steps. How would you approach a source-code security review of a TypeScript service? I would first understand the service architecture, trust boundaries, dependencies, authentication flows, and data handling. I would then inspect authorization logic, input validation, deserialization, secrets management, error handling, cryptographic use, and third-party packages, while tracing high-risk data flows from entry points to sensitive operations. What are important security areas to assess when testing a mobile application? I assess local data storage, certificate validation, transport security, authentication and session handling, deep links, exported components, WebView behavior, API authorization, reverse-engineering resistance, and leakage through logs or backups. I test both the client and its backend APIs because client-side controls alone should not be trusted. How do you communicate a critical vulnerability to both technical and executive audiences? For technical teams, I provide concise evidence, affected components, reproducible steps, impact, root cause, and actionable remediation options. For executives, I focus on business impact, likelihood, affected assets, remediation priority, and residual risk, avoiding unnecessary exploit detail while making the decision required clear. What security risks are especially relevant when assessing a Web3 application or wallet? I would examine smart-contract authorization, access control, oracle and price-manipulation risks, reentrancy, transaction signing flows, key custody, seed-phrase exposure, wallet-connect integrations, RPC trust assumptions, and frontend attacks that could alter transaction parameters. I also consider economic attack paths and verify that findings are practical under real chain and protocol conditions. Opportunity details ## About this role. Why Us? CertiK is a pioneer in blockchain security, leveraging best-in-class AI technology to protect and monitor blockchain protocols and smart contracts. Founded in 2018 by professors from Yale University and Columbia University, CertiK’s mission is to secure the web3 world. CertiK applies cutting-edge innovations from academia to enterprise, enabling mission-critical applications to scale with safety and correctness. About the Role The primary responsibility of this role is for CertiK’s security-related services. Intersecting cybersecurity and blockchain, CertiK’s security offerings include security consulting, security reviews, security auditing of smart contracts and blockchains, verification of smart contracts, penetration testing, and more. We are looking to hire someone with a passion for application security and penetration testing. This is a fun and challenging full-time position. If you are excited about hacking, threat modeling, scanning, auditing, designing, and enhancing the security of applications across the board then you will thrive in this role. While you work with clients, we will also provide you with plenty of opportunities to get involved with research and development efforts to help us raise the standards of blockchain security. ### Responsibilities * Perform security assessments on web, mobile, thick client applications, and browser extensions * Conduct external and internal network penetration tests * Perform security source code reviews * Perform cloud security reviews * Develop comprehensive pentest reports for both technical and non-technical audiences * Research and develop innovative techniques, tools, and methodologies for pentesting applications in the blockchain space * Contribute to the community by developing tools, presentations, and blog posts ### Requirements * Passionate about cryptocurrency, DeFi, and blockchain, with a willingness to learn Web3 technologies such as smart contracts * Minimum of 4 years of experience in application security and penetration testing * Experienced in source code review for different languages, with a strong understanding of JavaScript and TypeScript * Experienced in mobile application penetration testing * Familiar with cloud platforms and their security risks, such as AWS, Azure, and GCP * Experience in programming with scripting languages such as Python and Bash * Solid understanding of cryptography * BS/MS/PhD in Computer Science or Information Security * Strong spoken and written communication skills ### Bonus Points * Experienced in pentesting Web3 applications such as crypto exchanges, wallets, Dapps, and key custodian solutions * Experienced in smart contract security audits * Familiar with browser extension architecture and security risks * Actively participate in the blockchain security community * OSCP, OSWE, OSCE, GWAPT, or comparable certification * Participated in bug bounty programs and audit contests * Published security-related blog posts and spoken at security conferences and/or local meetups ### Compensation ### Additional Information About the Company One of the fastest-growing and most trusted companies in blockchain security, CertiK is a true market leader. To date, CertiK has worked with over 3,200 Enterprise clients, secured over $310 billion worth of digital assets, and has detected over 60,000 vulnerabilities in blockchain code. Our clients include leading projects such as Aave, Polygon, Binance Smart Chain, Terra, Yearn, and Chiliz. Investors = Insight Partners, Sequoia, Tiger Global, Coatue Management, Lightspeed, Advent International, SoftBank, Hillhouse Capital, Goldman Sachs, Coinbase Ventures, Binance, Shunwei Capital, IDG Capital, Wing, Legend Star, Danhua Capital and other investors. Compensation Target annual base salary for this role performed in the US is $100,000 – $180,000. The exact compensation at which this job is filled will be determined by the skills and experience of qualified candidates. #LI-Remote #blockchain #startups #hiring CertiK is proud to offer medical, vision, and dental insurance, 401(k) plan with company matching, life and accidental death and dismemberment insurance, HSA (with high deductible plan), FSA, and other benefits to all full-time employees, along with flexible paid time off and holidays. CertiK also offers a variable commission program for business development sales roles. In compliance with federal law, all persons hired will be required to verify identity and eligibility to work in the United States and to complete the required employment eligibility verification form upon hire. CertiK is proud to be an equal opportunity employer. We will not discriminate against any applicant or employee on the basis of age, race, color, creed, religion, sex, sexual orientation, gender, gender identity or expression, medical condition, national origin, ancestry, citizenship, marital status or civil partnership/union status, physical or mental disability, pregnancy, childbirth, genetic information, military and veteran status, or any other basis prohibited by applicable federal, state or local law. CertiK will consider for employment qualified applicants with criminal histories in a manner consistent with local and federal requirements. [https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf](https://www.eeoc.gov/sites/default/files/migrated_files/employers/poster_screen_reader_optimized.pdf) All CertiK employees are expected to actively support diversity on their teams, and in the Company. Show more [Apply now >](https://jobicy.com/jobs/157443-sr-security-engineer-penetration-testing.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Software Engineer, Firefox Security](https://jobicy.com/jobs/157410-senior-software-engineer-firefox-security.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Security GRC Engineer](https://jobicy.com/jobs/157406-senior-security-grc-engineer.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Security Engineer – SecOps](https://jobicy.com/jobs/157401-senior-security-engineer-secops.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Socket logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1314ce3c-221.png) Socket Oct 27 New ### [Vulnerability Research Software Engineer](https://jobicy.com/jobs/157395-vulnerability-research-software-engineer.md) About Us Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 27 New ### [Senior Phishing Tradecraft Researcher](https://jobicy.com/jobs/157339-senior-phishing-tradecraft-researcher.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 27 New ### [Senior Manager, Detection Engineering & Threat Hunting](https://jobicy.com/jobs/157334-senior-manager-detection-engineering-threat-hunting.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 27 New ### [Principal Product Security Researcher](https://jobicy.com/jobs/157330-principal-product-security-researcher-2.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 27 New ### [Principal Product Security Engineer](https://jobicy.com/jobs/157328-principal-product-security-engineer.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Airtm logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1994f28e-221.png) Airtm Oct 27 New ### [Head of security](https://jobicy.com/jobs/157316-head-of-security-2.md) About us: Airtm is a financial-infrastructure company building the future of the online-work economy. We are on a mission to empower the world’s growing number of Digital Entrepreneurs in the… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 27 New ### [Security Engineer, Agent Security](https://jobicy.com/jobs/151775-security-engineer-agent-security.md) About the TeamThe team’s mission is to accelerate the secure evolution of agentic AI systems at OpenAI. To achieve this, the team designs, implements, and continuously refines security policies, frameworks,… [Browse all jobs](https://jobicy.com/jobs.md)