Lead and develop the Application Security team for MetaMask, owning strategy, OKRs, KPIs, threat modelling, security design reviews, secure SDLC, supply chain controls, code review, vulnerability management, and external testing programs (bug bounty, pentests). Requires ~8+ years in AppSec or security-focused engineering with at least 2 years people management and strong practical code review skills in TypeScript/JavaScript, Go or Solidity. Role reports to Head of Security and works closely with engineering leadership. Remote-first within EMEA, explicitly not considering candidates based in France, Italy, or Germany.

Responsible for operating the risk register and posture engine (register, evidence, audit ops) using Drata; running critical control monitoring and automation; coordinating ISO 27001 and SOC 2 audits, customer questionnaires, and external testing (red team, pentest); maintaining ISMS and security policy library; and reporting residual risk and exceptions. Qualifications call for hands-on GRC experience, audit coordination, strong written work, stakeholder management, and certifications such as CISA or ISO 27001 Lead Implementer/Auditor. Applications from France, Italy, and Germany are excluded. US pay range: $150,000–$206,000 USD (year).