Join Merkl as a Junior Cybersecurity Engineer – Help Shape the Future of Onchain Incentives

💼 Job Title

Junior Cybersecurity Engineer (Merkl)

🥨 About Merkl

Merkl is the infrastructure for onchain money streaming and distribution. Stablecoin issuers, fintechs, neobanks, tokenized funds, and DeFi protocols use Merkl to calculate and send yield, dividends, rewards, and payouts across 60+ chains. Since launching in July 2023, we've distributed over $1.8B, work with 1000+ companies, and have sent rewards to 5M+ unique wallets.

We power distributions for leading names in crypto and fintech, including Coinbase, PayPal, Robinhood, Kraken, MetaMask, Uniswap, Aave, Morpho, Ethena, Sky, Euler, 1inch, and Trezor, and run chain-wide programs for Plasma, World Chain, Optimism, Robinhood Chain, and more. Many of our clients, like Morpho, initially built their own reward systems in-house before switching to Merkl, because we're faster, cheaper, and more flexible.

You may have already used Merkl without knowing it: we power products like Robinhood Earn and provide white-label solutions embedded in major frontends like Uniswap and Trust Wallet.

In short, we enable the seamless distribution of value to any onchain behavior, while giving 200K+ monthly active users access to the best opportunities across 20,000+ campaigns through the Merkl App. We move fast, integrate in days, and with exciting announcements on the horizon, we're looking for a Junior Cybersecurity Engineer to help us maintain that momentum and strengthen our team of superbuilders 💪🛠️

We can’t wait for you to build the next phase of Merkl!

💪 Team

Merkl is a small team of 20 people. If you join the team, you will learn alongside us and be deeply involved in product design and the research we are conducting.

📍 Location

🥖 Paris (Hybrid)

🛠 Missions & Responsibilities

As a Junior Cybersecurity Engineer at Merkl, you will help protect the systems that move billions of dollars in rewards onchain. With $1.8B+ distributed and millions of users relying on our infrastructure, security is not a feature for us: it is the foundation of the trust our partners place in Merkl. You will work across every team (Engine, Product, Infra) to find weaknesses before attackers do, make sure they get fixed, and continuously raise the security bar of the whole company. You will work closely with our senior engineers and the Infra team, who will support and mentor you as you ramp up. Step by step, you will take ownership of our bug bounty program, challenge our people and processes through internal red team exercises, and become the go-to person for everything related to vulnerability management during our security audits. It's a unique opportunity to learn security hands-on, on real high-stakes systems, with a lot of responsibility early on.

Specifically, your responsibilities will include:

• Running our bug bounty program: triaging incoming submissions, assessing their severity and real-world impact with the support of senior engineers, communicating with researchers, and owning the associated fix tasks end-to-end until they are shipped and verified.
• Running internal, educational pentests (red team): simulating social engineering attacks (phishing, pretexting, ...), stress-testing our development processes (code review, CI/CD, secrets, access management, ...), and attempting various injections and exploits against our applications and APIs.
• Turning every finding into a learning opportunity: sharing results with the team in a pedagogical way, running post-mortems and awareness sessions, and helping engineers build a security-first mindset.
• Owning evidence in security audits: being responsible for the proofs related to vulnerability management (scanning, triage, remediation SLAs, tracking, reporting, ...) and working with auditors to demonstrate our security posture.