Blockchain Security Researcher

Blockchain Lab analysis

Security research and review, as the posting describes Security Services. Not sales.

It does not own the Contracts repository, and it should not own a rating decision. If the interview starts blending those, that is the conflict question, live.

Blockchain Lab analysis

Public reporting and the employer’s own releases. Not a relationship with Blockchain Lab. Not a credit opinion.

Founded

2015, in Buenos Aires, as Zeppelin.

Base

Distributed. One posting says Remote - Worldwide. The other says Remote. Those are not the same sentence.

Status

Private, with a merger announced. S&P Global said on 17 September 2026 it had agreed to acquire the company. PitchBook marked the deal as announced, not as a closed integration.

People

PitchBook listed about 140 employees. Demian Brener remains CEO under the announced structure.

1. 2015–2018

   Early venture

   Not reliably public

   Databases list seed and Series A activity, including Fabric, BlueYard, Collaborative Fund, and True Ventures among historical investors. Amounts are paywalled or missing. We do not fill them in.

2. Mar 2023

   Later-stage VC

   Undisclosed

   PitchBook records a completed later-stage round. No post-money we will quote.

3. 17 Sep 2026

   Agreement to be acquired

   Undisclosed

   S&P Global said the deal is not expected to be material to its results. That sentence is aimed at S&P shareholders. For you it means the price was not large relative to S&P, not that your unvested equity is safe or worthless. Ask counsel.

• Deal not described as closed in every database. Your offer may be pre-close or post-close. The benefits, the option plan, and the employer of record change across that line.
• Undisclosed price. You cannot value an option against a blank.
• Services culture inside a public parent. Utilisation, conflicts, and a slower ship cycle are the ordinary result. Sometimes that is what you want.
• Solana versus the Ethereum brand. A principal seat on Solana can be a growth bet or a rounding error. Get it in writing.

Ask them

• Has the S&P transaction closed, and who is the employer of record on the offer?
• What happens to unvested equity, and is there a retention grant?
• Does Security Services stay independent of Ratings engagements?
• For Solana: is the library a funded roadmap or a single seat?
• Worldwide remote, on the researcher posting, means which employment entities and which tax setups?

• S&P Global announcement, 17 Sep 2026
• PitchBook company profile
• What the deal changes for builders

If a figure is not in those sources, it is not in this brief on purpose.

Illustrative preparation

Not the employer’s onboarding plan.

1. Days 1–30: one supervised review. Learn their severity scale before you invent one.
2. Days 31–60: a finding that changed the client's code, written so a non-author can replay it.
3. Days 61–90: a note on a class of bug you want the library, not the next client, to make impossible. Hand it to the people who own Contracts. Do not freelance a fork.

A week you can rehearse

• Review something small in public. Findings, severity, and a fix you could retest.
• Read the S&P release once. Know what you are walking into without reciting it at them.
• Prepare one question on independence you are willing to ask a future manager.

Illustrative preparation

• Present a real bug you found. Include the test.
• How do you disagree with a senior reviewer who wants a lower severity?
• What does an independent review mean if the parent also rates the client?

Proof you can build before you apply

• The security-review lab. Threat model, one mitigation, retest steps. Label it as your exercise, not as an audit of a live protocol.

Open Security review of a local demo. Review a local demo, write the threat model, and document one mitigation.

• Failure atlas
• Canon

• They cannot say whether your offer is OpenZeppelin or S&P.
• Utilisation targets are quoted and quality review is not.
• Worldwide means a contractor agreement in your country with no benefits they will describe.

Employer stated. OpenZeppelin's Security Services team reviews protocols and institutions. This posting is research, not a sales seat.

• Review smart contracts for top decentralized applications, blockchain infrastructure and financial institutions before they launch. Find vulnerabilities, prioritize them, and present findings to the client.
• Drive audits independently from start to finish, with AI as your primary collaborator. When useful, partner with another researcher to attack the code together and pressure-test findings.
• Partner with client teams during the design phase of new protocols, analyzing architecture, trust assumptions, and operational constraints before any code is written (Design Reviews, Applied Research engagements).
• Use AI efficiently throughout the audit process, and build skills, agents, and workflows that compound across the team.
• Conduct open-ended research into cutting-edge blockchain technologies, vulnerability classes, and emerging attack vectors, and contribute findings back to OpenZeppelin's internal knowledge base and to the broader ecosystem.

Source: the employer’s public Greenhouse record, job 4254142003. Open the original. First seen by this desk 2026-10-06. Nothing above the fold is a substitute for that page.

Blockchain Lab analysis. These lines are a reading of the advertisement. They are not extra hiring requirements.

• Threat-model the privilege boundary before the bug list.
• Tie each finding to a concrete control, not a slogan.
• Show how you would re-test the fix.

• Compensation, unless a figure appears in the header. None of these eighteen postings stated one.
• Closing date, and the day the role was first published. The board timestamp is an update.
• Visa sponsorship, on-call, and the employing subsidiary.