Junior Cybersecurity Engineer

Merkl is the leading financial infrastructure for onchain money streaming. Finance is moving onchain: stablecoins, tokenized stocks and funds, onchain payments. Each of them comes with money that has to stream to someone: dividends to shareholders, interest to stablecoin holders, salaries to employees. Merkl is how that money gets there. Stablecoin issuers, fintechs, neobanks, tokenized funds, and DeFi protocols use us to calculate and send yield, dividends, rewards, and payouts.

Since July 2023, we have distributed $1.8B+ to 5M+ wallets across 60+ chains, for 1000+ companies including Coinbase, PayPal, Robinhood, Kraken, MetaMask, and Uniswap. We are independent, and the global leader in our category.

We're looking for a Junior Cybersecurity Engineer to help build the next phase of Merkl.

Merkl is a small team of 20 people. If you join the team, you will learn alongside us and be deeply involved in product design and the research we are conducting.

As a Junior Cybersecurity Engineer at Merkl, you will help protect the systems that move billions of dollars in rewards onchain. With $1.8B+ distributed and millions of users relying on our infrastructure, security is not a feature for us: it is the foundation of the trust our partners place in Merkl. You will work across every team (Engine, Product, Infra) to find weaknesses before attackers do, make sure they get fixed, and continuously raise the security bar of the whole company.

You will work closely with our senior engineers and the Infra team, who will support and mentor you as you ramp up. Step by step, you will take ownership of our bug bounty program, challenge our people and processes through internal red team exercises, and become the go-to person for everything related to vulnerability management during our security audits. It's a unique opportunity to learn security hands-on, on real high-stakes systems, with a lot of responsibility early on.

Specifically, your responsibilities will include:

• •Running our bug bounty program: triaging incoming submissions, assessing their severity and real-world impact with the support of senior engineers, communicating with researchers, and owning the associated fix tasks end-to-end until they are shipped and verified.
• •Running internal, educational pentests (red team): simulating social engineering attacks (phishing, pretexting, ...), stress-testing our development processes (code review, CI/CD, secrets, access management, ...), and attempting various injections and exploits against our applications and APIs.
• •Turning every finding into a learning opportunity: sharing results with the team in a pedagogical way, running post-mortems and awareness sessions, and helping engineers build a security-first mindset.
• •Owning evidence in security audits: being responsible for the proofs related to vulnerability management (scanning, triage, remediation SLAs, tracking, reporting, ...) and working with auditors to demonstrate our security posture.
• •Building and maintaining our vulnerability management process: from detection (SAST/DAST/SCA, dependency scanning, ...) to prioritization, remediation and follow-up.
• •Collaborating with the Infra and Engine teams to harden our cloud infrastructure, applications, and data pipelines.

By joining the Merkl team, you will be part of one of the most innovative and fast-growing teams in onchain finance. We offer the opportunity to work with an ambitious team, shipping quickly and making an impact in the industry. For full-time positions, we provide:

• •A highly stimulating intellectual environment: You'll collaborate with some of the best researchers and engineers in onchain finance, on systems that move real money for Coinbase, Robinhood, and PayPal. Our stack is solid web2 engineering (TypeScript, Go, Postgres, Kubernetes) applied to financial infrastructure.
• •An AI-native way of working: AI coding agents, whichever one you prefer, and our own MCP servers are part of everyone's daily workflow. You get the best tools, and the time they save goes into understanding more of the system, not only shipping more code.
• •Growth and future opportunities: Be part of an independent, rapidly scaling company, working on the infrastructure that shapes the future of finance.
• •Competitive salary: We offer a competitive compensation package with flexible working hours, ensuring a healthy work-life balance.
• •Equipment stipend: We provide you with the tools and devices you need to optimize your work environment and fit your working style.
• •Team retreats: Every year, you'll have the chance to join the team on retreats to reflect on our journey, plan for the future, and bond while having fun in exciting locations.

You're at the beginning of your career in cybersecurity, passionate about breaking (and fixing) things, and eager to grow fast in a fast-paced, innovative environment. We're looking for someone who is:

• •A fast learner and problem-solver: You are intellectually curious, able to quickly grasp new technologies and concepts, and have a knack for finding innovative solutions to complex technical issues.
• •Hungry to learn: You're not afraid to ask questions, you welcome feedback, and you spend part of your free time on CTFs, labs, or reading write-ups.
• •Equipped with an attacker's mindset: You love understanding how things work at a fundamental level, and even more how they can break. You enjoy digging into the technical details of systems.
• •A great communicator and educator: You know how to explain a vulnerability to an engineer, a founder, or an auditor, and you'd rather teach the team than point fingers.
• •Driven by data and startup values: You iterate quickly, love testing new ideas (even the most unconventional ones), and are excited to implement them.
• •Collaborative: You work well in a small, agile team where everyone's contributions are valued.
• •Ownership-focused: You take responsibility for your tasks and see projects through to completion, from the first report to the deployed fix.
• •Excited about the future of finance: You want to protect infrastructure that moves real money. No crypto background needed: you'll learn that side with us.

• •A first experience in cybersecurity (internship, apprenticeship, or first job), or equivalent hands-on experience through CTFs, home labs, or personal projects.
• •Solid knowledge of web application security fundamentals (OWASP Top 10, injections, authentication and authorization flaws, SSRF, ...) and hands-on practice with tools like Burp Suite or equivalent.
• •An interest in bug bounty: you know how programs work (e.g., Immunefi, HackerOne, Cantina, ...), and you may have already reported a few findings yourself.
• •Curiosity for social engineering and security awareness (phishing simulations, pretexting, ...).
• •A basic understanding of vulnerability management and its tooling (SAST/DAST/SCA, dependency scanning, ...).
• •An interest in security audits and compliance frameworks (e.g., SOC 2, ISO 27001): no prior audit experience required, you'll learn it with us.
• •Good fundamentals in Linux, networking, and cloud environments. Knowledge of Google Cloud Platform (GCP) or Kubernetes is a plus.
• •Comfort reading and writing code (ideally TypeScript, Golang, Solidity) to understand vulnerabilities, write PoCs, and contribute to fixes.
• •The willingness to take ownership of your tasks and see them through from start to finish.
• •Efficiency: Eager to automate every repetitive part of your missions to always move faster and push the boundaries.

Bonus:

• •Experience with smart contract security (Solidity, EVM) or DeFi protocols.
• •Security certifications such as eJPT, OSCP, or equivalent (or currently preparing one).
• •Participation in CTFs or public bug bounty findings.
• •Track record in Root-me or other cyber training platforms.

Our hiring process is structured around 5 steps:

• →Screening [30 mins]: interview with a team member, deep dive into your background
• →Take-home technical case [max 2 hrs]: screening technical assessment for the position
• →Technical interview [1 hr]: discussion on the case, brainteasers, interview on job-specific skills
• →Cultural-fit interview [1 hr]: interview with potential future team members
• →Final interview [45 mins]: conversation with co-founders

If you have a question about the position, contact us directly at [email protected].