Senior Security Engineer, Insider Trust

📋 Job Overview

Chainlink Labs is seeking a Senior Security Engineer, Insider Trust to join our Security Department. The Security Department is the guardian of Chainlink Labs’ people, infrastructure, and data, safeguarding against threats from external and internal sources. The Insider Trust Team (ITT) Senior Security Engineer will lead efforts in identifying, investigating, and mitigating security policy violations and deviations from CLL’s security best practices.

🏢 About Chainlink

Chainlink is the industry-standard oracle platform bringing the capital markets onchain and powering the majority of decentralized finance (DeFi). The Chainlink stack provides the essential data, interoperability, compliance, and privacy standards needed to power advanced blockchain use cases for institutional tokenized assets, lending, payments, stablecoins, and more. Since inventing decentralized oracle networks, Chainlink has enabled tens of trillions in transaction value and now secures the vast majority of DeFi.

🎯 The Role

The Security Department is the guardian of Chainlink Labs’ people, infrastructure, and data. Its principal objective is to safeguard Chainlink Labs and its assets against threats from external and internal sources. The Insider Trust Team (ITT) Senior Security Engineer is responsible for leading the effort in identifying, investigating, and mitigating security policy violations and deviations from CLL’s security best practices that cause, or have the potential to cause, harm to personnel, systems, facilities, plans, intentions, capabilities, and/or brand reputation.

✅ Key Responsibilities

• Own and lead building out the Insider Trust Team’s infrastructure to engineer and automate end-to-end detection and investigation workflows.
• Develop, measure, and tune detection rules in Sigma to ensure effective and sustainable operations.
• Drive projects with a focus on Insider Risks, ranging from access abuse and intellectual property theft, to novel risks emerging within the blockchain/Web3 space.
• Work closely with cross-functional teams, including Threat Management, People, Legal, IT, and Engineering, and provide technical expertise and evidence to lead insider investigations.
• Assist in conducting sensitive interviews during insider threat investigations, bringing your technical subject matter expertise to support fact finding.
• Proactively identify and implement areas of improvement and modernization.

📌 Required Qualifications

• 7+ years of experience conducting technical investigations and working in an Insider Threat capacity.
• Deep experience in macOS focused environments, including log collection, log analysis, digital investigations, and forensics.
• Knowledge of Insider Threat tactics and attack paths, data exfiltration techniques, and experience running and leading insider incidents independently and as part of a team.
• Broad familiarity with Insider Threat investigations of modern cloud infrastructure.
• Strong critical thinking skills, as well as integrity, objectivity, and maturity.

⭐ Desirable Experience

• Prior success in remote-first environments as a self-starter Insider Threat security engineer.
• Previous scripting experience (Python, Bash, or similar) to include scripting for data parsing/enrichment and automations.
• Experience with detection‑as‑code development and workflows in Sigma.
• Collaborative, straightforward communication skills with the ability to write clear incident updates and summaries.
• Domain experience with blockchain/Web3 threats.
• Usage of AI technology to augment and enhance Insider Threat investigations.
• Open-source contributions to security related projects, with a focus on Insider Threat.

🎁 Benefits

The estimated cash compensation for this role is based on job-related factors including relevant skills, experience, qualifications, and geographic location. Chainlink Labs follows a zone-based compensation model. In addition to competitive cash compensation, Chainlink Labs provides long-term incentives and comprehensive benefits. Actual compensation packages are discussed and finalized during the offer process.

🛂 Visa & Eligibility

All roles with Chainlink Labs are global and remote-based. Unless otherwise stated, we ask that you try to overlap some working hours with Eastern Standard Time (EST). We carefully review all applications and aim to provide a response to every candidate within two weeks after the job posting closes.