Security Researcher, Fuzzing - Parapet Labs

𝗥𝗲𝗺𝗼𝘁𝗲 | 𝗙𝘂𝗹𝗹-𝘁𝗶𝗺𝗲

Parapet Labs is a smart contract security firm. We protect DeFi and Web3 protocols that hold real money, by finding the flaws before an attacker does. Our work covers EVM and SVM code review, AI-assisted scanning, protocol design review and fix verification.

We are small on purpose and senior-only. Manual review finds a lot, but not everything, and you are the person who finds the rest.

Quality is the whole product, so quality is how we operate.

• 𝗦𝗲𝗻𝗶𝗼𝗿 𝗲𝘆𝗲𝘀 𝗼𝗻 𝗲𝘃𝗲𝗿𝘆 𝗲𝗻𝗴𝗮𝗴𝗲𝗺𝗲𝗻𝘁. No juniors on client code.

• 𝗙𝗶𝗻𝗱𝗶𝗻𝗴𝘀 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗵𝗲 𝗳𝗶𝗻𝗮𝗹 𝗿𝗲𝗽𝗼𝗿𝘁. Confirmed critical issues go to the client the same day.

• 𝗥𝗮𝗻𝗸𝗲𝗱 𝗮𝗻𝗱 𝗮𝗰𝘁𝗶𝗼𝗻𝗮𝗯𝗹𝗲. Every finding is severity-ranked and comes with a fix.

• 𝗪𝗲 𝗿𝗲-𝗰𝗵𝗲𝗰𝗸 𝘁𝗵𝗲 𝗳𝗶𝘅𝗲𝘀. Patches are reviewed before the client ships.

• 𝗣𝗿𝗼𝗼𝗳 𝗼𝘃𝗲𝗿 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀. We care what you have built and broken, not your résumé.

It is a high-standards environment. The bar is high, the feedback is direct, and the work is judged on whether it actually catches bugs, not on how much tooling it contains.

𝗧𝗵𝗲 𝗿𝗼𝗹𝗲:

You own the fuzzing, invariant tests and formal specifications that catch what manual review may miss. You work alongside our auditors: they read the code and form hypotheses, and you turn those hypotheses, plus your own, into properties that a machine can try to break.

• Design and write invariant tests and fuzzing campaigns for client protocols using Foundry, Echidna or Medusa.

• Turn a protocol's intended behavior into properties that mean something, covering accounting, solvency, access and state transitions.

• Work with auditors to convert a suspected issue into a reproducible failing test.

• Build and maintain our internal harnesses, tooling and reusable invariant libraries.

• Write formal specs where fuzzing alone is not enough.

• Triage fuzzer output: separate real bugs from noise and explain what each one means.

• Hands-on experience with Foundry, Echidna or Medusa on real protocols.

• 𝗬𝗼𝘂 𝘄𝗿𝗶𝘁𝗲 𝗶𝗻𝘃𝗮𝗿𝗶𝗮𝗻𝘁𝘀 𝘁𝗵𝗮𝘁 𝗺𝗲𝗮𝗻 𝘀𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴, not harnesses that go through the motions. We will ask you to show us one.

• Working knowledge of EVM internals and common economic attack vectors.

• Solid Solidity skills, enough to read a large codebase and model it properly.

• You can explain a property, a counterexample and why it matters to a non-specialist.

• You work well independently and remotely, and write clearly.

• Formal verification experience (Certora, Halmos, Kontrol, or similar).

• Experience with stateful fuzzing of complex DeFi systems: lending, AMMs, vaults, bridges.

• Public work: contest findings, bounty reports, open-source harnesses, or write-ups.

• Experience with SVM / Solana testing tools.

• Experience building or extending fuzzing or analysis tools.

• Fully remote work with a small team of senior security people.

• Real protocols and real stakes, with complex DeFi systems where good invariants matter.

• Time and room to build proper tooling, not just run someone else's.

• Direct feedback and real collaboration with the auditors on your findings.

• Competitive compensation.