Join Merkl as a Junior Cybersecurity Engineer – Help Shape the Future of Onchain Incentives

💼 Job Title

Junior Cybersecurity Engineer (Merkl)

🥨 About Merkl

Merkl is the infrastructure for onchain money streaming and distribution. Stablecoin issuers, fintechs, neobanks, tokenized funds, and DeFi protocols use Merkl to calculate and send yield, dividends, rewards, and payouts across 60+ chains. Since launching in July 2023, we've distributed over $1.8B, work with 1000+ companies, and have sent rewards to 5M+ unique wallets.

We power distributions for leading names in crypto and fintech, including Coinbase, PayPal, Robinhood, Kraken, MetaMask, Uniswap, Aave, Morpho, Ethena, Sky, Euler, 1inch, and Trezor, and run chain-wide programs for Plasma, World Chain, Optimism, Robinhood Chain, and more. Many of our clients, like Morpho, initially built their own reward systems in-house before switching to Merkl, because we're faster, cheaper, and more flexible.

You may have already used Merkl without knowing it: we power products like Robinhood Earn and provide white-label solutions embedded in major frontends like Uniswap and Trust Wallet.

In short, we enable the seamless distribution of value to any onchain behavior, while giving 200K+ monthly active users access to the best opportunities across 20,000+ campaigns through the Merkl App. We move fast, integrate in days, and with exciting announcements on the horizon, we're looking for a Junior Cybersecurity Engineer to help us maintain that momentum and strengthen our team of superbuilders 💪🛠️

We can’t wait for you to build the next phase of Merkl!

💪 Team

Merkl is a small team of 20 people. If you join the team, you will learn alongside us and be deeply involved in product design and the research we are conducting.

📍 Location

🥖 Paris (Hybrid)

🛠 Missions & Responsibilities

As a Junior Cybersecurity Engineer at Merkl, you will help protect the systems that move billions of dollars in rewards onchain. With $1.8B+ distributed and millions of users relying on our infrastructure, security is not a feature for us: it is the foundation of the trust our partners place in Merkl. You will work across every team (Engine, Product, Infra) to find weaknesses before attackers do, make sure they get fixed, and continuously raise the security bar of the whole company. You will work closely with our senior engineers and the Infra team, who will support and mentor you as you ramp up. Step by step, you will take ownership of our bug bounty program, challenge our people and processes through internal red team exercises, and become the go-to person for everything related to vulnerability management during our security audits. It's a unique opportunity to learn security hands-on, on real high-stakes systems, with a lot of responsibility early on.

Specifically, your responsibilities will include:

• Running our bug bounty program: triaging incoming submissions, assessing their severity and real-world impact with the support of senior engineers, communicating with researchers, and owning the associated fix tasks end-to-end until they are shipped and verified.
• Running internal, educational pentests (red team): simulating social engineering attacks (phishing, pretexting, ...), stress-testing our development processes (code review, CI/CD, secrets, access management, ...), and attempting various injections and exploits against our applications and APIs.
• Turning every finding into a learning opportunity: sharing results with the team in a pedagogical way, running post-mortems and awareness sessions, and helping engineers build a security-first mindset.
• Owning evidence in security audits: being responsible for the proofs related to vulnerability management (scanning, triage, remediation SLAs, tracking, reporting, ...) and working with auditors to demonstrate our security posture.
• Building and maintaining our vulnerability management process: from detection (SAST/DAST/SCA, dependency scanning, ...) to prioritization, remediation and follow-up.
• Collaborating with the Infra and Engine teams to harden our cloud infrastructure, applications, and data pipelines.

🎁 What We Offer

By joining the Merkl team, you will be part of one of the most innovative and fast-growing teams in DeFi. We offer the opportunity to work with an ambitious team, shipping quickly and making an impact in the industry. For full-time positions, we provide:

• 🧠 A highly stimulating intellectual environment: You'll collaborate with some of the best researchers and engineers in the DeFi space, constantly pushing the boundaries of what's possible. You'll also gain exposure to Merkl's robust web2 tech stack, providing valuable learning opportunities as you work on bridging traditional and decentralized technology.
• 👑 Growth and future opportunities: Be part of a rapidly scaling company, working on cutting-edge projects that shape the future of DeFi.
• 💰 Competitive salary: We offer a competitive compensation package with flexible working hours and the option to work remotely, ensuring a healthy work-life balance.
• 🖥️ Equipment Stipend: We provide you with the tools and devices you need to optimize your work environment and fit your working style.
• 🍻 Team Retreats: Every year, you'll join the team on retreats to reflect on our journey, plan for the future, and bond while having fun in exciting locations.

🧙‍♂️ You Are

You're at the beginning of your career in cybersecurity, passionate about breaking (and fixing) things, and eager to grow fast in a fast-paced, innovative environment. We're looking for someone who is:

• A fast learner and problem-solver: You are intellectually curious, able to quickly grasp new technologies and concepts, and have a knack for finding innovative solutions to complex technical issues.
• Hungry to learn: You're not afraid to ask questions, you welcome feedback, and you spend part of your free time on CTFs, labs, or reading write-ups. an attacker's mindset: You love understanding how things work at a fundamental level, and even more how they can break. You enjoy digging into the technical details of systems.
• A great communicator and educator: You know how to explain a vulnerability to an engineer, a founder, or an auditor, and you'd rather teach the team than point fingers.
• Driven by data and startup values: You iterate quickly, love testing new ideas (even the most unconventional ones), and are excited to implement them.
• Collaborative: You work well in a small, agile team where everyone's contributions are valued.
• Ownership-focused: You take responsibility for your tasks and see projects through to completion, from the first report to the deployed fix.
• Excited about DeFi: You are enthusiastic about the potential of decentralized finance and eager to push its boundaries.

📖 You Have

• A first experience in cybersecurity (internship, apprenticeship, or first job), or equivalent hands-on experience through CTFs, home labs, or personal projects.
• Solid knowledge of web application security fundamentals (OWASP Top 10, injections, authentication and authorization flaws, SSRF, ...) and hands-on practice with tools like Burp Suite or equivalent.
• An interest in bug bounty: you know how programs work (e.g., Immunefi, HackerOne, Cantina, ...), and you may have already reported a few findings yourself.
• Curiosity for social engineering and security awareness (phishing simulations, pretexting, ...).
• A basic understanding of vulnerability management and its tooling (SAST/DAST/SCA, dependency scanning, ...).
• An interest in security audits and compliance frameworks (e.g., SOC 2, ISO 27001): no prior audit experience required, you'll learn it with us.
• Good fundamentals in Linux, networking, and cloud environments. Knowledge of Google Cloud Platform (GCP) or Kubernetes is a plus.
• Comfort reading and writing code (ideally TypeScript, Golang, Solidity) to understand vulnerabilities, write PoCs, and contribute to fixes.
• The willingness to take ownership of your tasks and see them through from start to finish.
• Efficiency: Eager to automate every repetitive part of your missions to always move faster and push the boundaries.
• Bonus: Experience with smart contract security (Solidity, EVM) or DeFi protocols.
• Bonus: Security certifications such as eJPT, OSCP, or equivalent (or currently preparing one).
• Bonus: Participation in CTFs or public bug bounty findings.
• Bonus: Track record in Root-me or other cyber training platform.

📩 Ready to Apply?

If you're excited about joining Merkl as a Junior Cybersecurity Engineer, click the link below to submit your application through our form. We can't wait to hear from you!

Apply Now!

Merkl's Application Form

💡 If you have a question about the position, you can contact us directly at pveyrat@merkl.xyz

Process

Our hiring process is structured around 5 steps:

• Screening [30 mins]: interview with a team member, deep dive into your background
• Take-home technical case [max 2 hrs]: screening technical assessment for the position
• Technical interview [1 hr]: discussion on the case, brainteasers, interview on job-specific skills
• Cultural-fit interview [1 hr]: interview with potential future team members
• Final interview [45 mins]: conversation with co-founders