Senior Security Engineer, Insider Trust

About Chainlink
Chainlink is the industry-standard oracle platform bringing the capital markets onchain and powering the majority of decentralized finance (DeFi). The Chainlink stack provides the essential data, interoperability, compliance, and privacy standards needed to power advanced blockchain use cases for institutional tokenized assets, lending, payments, stablecoins, and more. Since inventing decentralized oracle networks, Chainlink has enabled tens of trillions in transaction value and now secures the vast majority of DeFi.

Many of the world’s largest financial services institutions have also adopted Chainlink’s standards and infrastructure, including Swift, Euroclear, Mastercard, Fidelity International, UBS, S&P Dow Jones Indices, FTSE Russell, WisdomTree, ANZ, and top protocols such as Aave, Lido, GMX and many others. Chainlink leverages a novel fee model where offchain and onchain revenue from enterprise adoption is converted to LINK tokens and stored in a strategic Chainlink Reserve. Learn more at chain.link.

About The Role

• The Security Department is the guardian of Chainlink Labs’ people, infrastructure, and data. Its principal objective is to safeguard Chainlink Labs and its assets against threats from external and internal sources. It accomplishes this mission through a combination of specialized security engineering, the deployment of cutting-edge technologies, and forward-thinking policy development. The Security Department also fosters a culture of security awareness throughout the entire company in order to safeguard our most valuable assets—our team members. To this end, the Insider Trust Team (ITT) Senior Security Engineer is responsible for leading the effort in identifying, investigating, and mitigating security policy violations and deviations from CLL’s security best practices that cause, or have the potential to cause, harm to personnel, systems, facilities, plans, intentions, capabilities, and/or brand reputation. To prevent such incidents in the first place, he or she not only conducts technical investigations, but will also help architect detection strategies with a focus on automation and build out scalable infrastructure to manage it. (Note: The industry standard term is “Insider Threat.” We use the term “Insider Trust” here at CLL.

Your Impact

• Own and lead building out the Insider Trust Team’s infrastructure to engineer and automate end-to-end detection and investigation workflows.

• Develop, measure, and tune detection rules in Sigma to ensure effective and sustainable operations.

• Drive projects with a focus on Insider Risks, ranging from access abuse and intellectual property theft, to novel risks emerging within the blockchain/Web3 space.

• Work closely with cross-functional teams, including Threat Management, People, Legal, IT, and Engineering, and provide technical expertise and evidence to lead insider investigations.

• Assist in conducting sensitive interviews during insider threat investigations, bringing your technical subject matter expertise to support fact finding.

• Proactively identify and implement areas of improvement and modernization.

Requirements

• 7+ years of experience conducting technical investigations and working in an Insider Threat capacity. We are seeking senior candidates.

• Deep experience in macOS focused environments, including log collection, log analysis, digital investigations, and forensics.

• Knowledge of Insider Threat tactics and attack paths, data exfiltration techniques, and experience running and leading insider incidents independently and as part of a team.

• Broad familiarity with Insider Threat investigations of modern cloud infrastructure.

• Strong critical thinking skills, as well as integrity, objectivity, and maturity.

Preferred Requirements

• Prior success in remote-first environments as a self-starter Insider Threat security engineer.

• Previous scripting experience (Python, Bash, or similar) to include scripting for data parsing/enrichment and automations.

• Experience with detection‑as‑code development and workflows in Sigma.

• Collaborative, straightforward communication skills with the ability to write clear incident updates and summaries. Ability to explain risk, impact, and trade‑offs to both technical and non‑technical stakeholders and have a proven record of building trust with partner teams during high‑pressure situations.

• Domain experience with blockchain/Web3 threats.

• Usage of AI technology to augment and enhance Insider Threat investigations

• Open-source contributions to security related projects, with a focus on Insider Threat.

All roles with Chainlink Labs are global and remote-based. Unless otherwise stated, we ask that you try to overlap some working hours with Eastern Standard Time (EST).

We carefully review all applications and aim to provide a response to every candidate within two weeks after the job posting closes. The closing date is listed on the job advert, so we encourage you to take the time to thoughtfully prepare your application. We want to fully consider your experience and skills, and you will hear from us regarding the status of your application shortly after the closing date.

Commitment to Equal Opportunity

Chainlink Labs is an equal opportunity employer. All qualified applicants will receive equal consideration for employment in compliance with applicable laws, regulations, or ordinances. If you need assistance or accommodation due to a disability or special need when applying for a role or in our recruitment process, please contact us via this form.

Global Data Privacy Notice for Job Candidates and Applicants

Information collected and processed as part of your Chainlink Labs Careers profile, and any job applications you choose to submit, is subject to our Recruiting Privacy Policy. By submitting your application, you are agreeing to our use and processing of your data as required.