§ 04
Security & Audit
Security hiring rewards demonstrated findings over titles. Public reports, disclosed vulnerabilities and competition results are the evidence. We search permanently across audit, protocol security and applied cryptography, including the leadership that sets security policy.
What this covers
- · Smart contract audit and review practices
- · Protocol and infrastructure security engineering
- · Applied cryptography, including zero-knowledge and multi-party computation
- · Security leadership, incident response and internal security functions
Roles we search for
- · Smart Contract Auditor
- · Security Engineer, protocol or infrastructure
- · ZK / Cryptography Engineer
- · Formal Verification Engineer
- · Head of Security or CISO for a protocol or exchange
- · Incident Response Lead
What the brief covers
- · Whether the role audits others' code or defends your own
- · Report volume and review depth expected
- · Disclosure and publication policy for findings
- · Access to production systems and keys, and the controls around it
- · Whether the role has budget and authority to block a release
What we ask candidates for, according to the role
- · Audit and security engineering: named public reports or disclosures, and their specific contribution
- · Audit and security engineering: a high-severity finding explained end to end, including impact, and where they draw the line between an issue and an informational note
- · Client-facing work: their process when a client disputes a finding
- · Operations and incident response: a process they owned, such as triage, on-call or disclosure handling
- · Leadership: their authority, what they decide does not get shipped, and how they set security policy
Things worth knowing before you start
- · Confirm what makes the role attractive to someone currently working on contract
- · Confirm the disclosure and publication policy for findings, in writing
- · Agree the authority the role holds, including whether it can block a release, in the brief
Questions we are asked
- Do you verify candidates' security claims?
- We record what a candidate tells us and the public evidence they point to. We do not run background, identity, right-to-work or reference checks, and we say so in every introduction.
- Can you support a first security hire?
- Yes. That usually starts with a brief conversation about what the role is genuinely accountable for.
- Are audits part of your service?
- No. We are a recruitment firm; we do not perform audits.
Hiring in Security & Audit? Tell us what the role needs and we will say honestly whether we can help.
Discuss a hire →