ANNOUNCED SALE · SECURITY · OpenZeppelin
Senior Blockchain Security Developer (Canton)
Senior blockchain security developer on OpenZeppelin’s Canton library: Daml contracts, reference implementations, and CIP standards with Digital Asset. Not the Ethereum audit practice and not the Solana principal seat.
You are deciding whether to join a crypto-native security firm in the weeks after it agreed to become a business unit of a ratings company, price undisclosed.
Blockchain Lab analysis, for a candidate deciding whether to apply. We are not the employer. Compensation on this posting: Not disclosed.
Listing age
8 days
Equity
Private. Illiquid.
Sale price
Not disclosed
Where
Remote
- Status
- Open on the employer board — checked 2026-10-06
- Board updated
- 2026-09-28 · 8 days before this check
- Location
- Remote
- Remote eligibility
- Remote. The posting does not say worldwide, and it does not name a country.
- Employment
- Not disclosed
- Compensation
- Not disclosed
- Experience, as stored
- Production Daml fluency is the bar the posting describes: templates, choices, controllers, observers, signatories, and multi-party authorization. A year count is not the sentence to memorize.
- Original post date
- Not disclosed
The company you would actually join
Blockchain Lab analysis
Public reporting and the employer’s own releases. Not a relationship with Blockchain Lab. Not a credit opinion.
- Founded
- 2015, in Buenos Aires, as Zeppelin.
- Base
- Distributed. One posting says Remote - Worldwide. The other says Remote. Those are not the same sentence.
- Status
- Private, with a merger announced. S&P Global said on 17 September 2026 it had agreed to acquire the company. PitchBook marked the deal as announced, not as a closed integration.
- People
- PitchBook listed about 140 employees. Demian Brener remains CEO under the announced structure.
OpenZeppelin became infrastructure by giving the library away. Contracts is MIT. The commercial company grew up beside it: reviews, monitoring, and a reputation that let a protocol say a serious firm had read the code. On 17 September 2026 S&P Global announced it had agreed to buy that company, keep the name, and have Brener report into S&P Global Ratings. The stated strategic reason is a code-to-credit stack: ratings and risk language for assets that now live on-chain. S&P has spent 2025 and 2026 on exactly that, including on-chain stablecoin assessments and a led round in Kaiko. OpenZeppelin is the engineering piece of that sentence.
Two facts sit underneath the press release. First, Defender is already dead as a hosted product. If your mental model is 'I will work on Defender', update it. Second, the Solana principal role and the security-researcher role are different businesses inside the same brand. One hardens libraries, and this seat is explicitly Solana, on a franchise the market still hears as Ethereum. The other reviews other people's protocols. A ratings-company parent can love the second more than the first, because reviews look like the business S&P already understands. Ask which P&L you are on after close.
Independence is the professional risk. An audit practice owned by a ratings company will be asked, by clients and by cynics, whether a finding can be soft when a rating relationship is hard. S&P will have an answer. You should decide whether you believe it before you take the seat. The library remaining open source is the part of the announcement that is easiest to verify and the part that least determines your Tuesday.
The Canton seat is a third business inside the same brand. The posting asks for a Daml contracts library and reference implementations — a privacy-preserving DEX, lending, stablecoin settlement — coordinated with Digital Asset and the Canton Foundation. That is not the Ethereum audit book and not the Solana principal role. Ask which of those three P&Ls survives inside a ratings company, and whether Canton is a funded roadmap or a single req.
Founders
Demian Brener
Co-founder and CEO
Founded the firm in Buenos Aires in 2015. Under the 17 September 2026 announcement he stays CEO and reports to Yann Le Pallec, president of S&P Global Ratings. The reporting line is the cultural fact. The logo is not.
Manuel Araoz
Co-founder of the library era
Widely credited with the early contracts work. He is not the operating CEO. Candidates who arrive expecting the 2017 blog culture will not find it. The firm that signs your offer is a services and standards business preparing to sit inside a public ratings company.
What the company sells
Contracts
The MIT-licensed library. The company says it remains open source and on GitHub through the deal. v5.6.1 shipped in February 2026.
Security engagements
Audits and design reviews for protocols and institutions. The announcement cites more than 900 engagements and more than 10,000 vulnerabilities caught before production. Those numbers are the company's.
What is gone
Defender, the hosted relay and monitor, closed on 1 July 2026 after a sunset notice the year before. Replacements are self-hosted and AGPL, not the old SaaS.
Capital
Sale price
Not disclosed
Announced 17 Sep 2026.
Company-stated footprint
$37 trillion transferred
S&P's announcement, attributing the library. Not an audit by us.
Engagements
900+
Same announcement. Company-stated.
Revenue
Not disclosed
Private, and now possibly immaterial to the buyer. That is a clue, not a number.
2015–2018
Early venture
Not reliably public
Databases list seed and Series A activity, including Fabric, BlueYard, Collaborative Fund, and True Ventures among historical investors. Amounts are paywalled or missing. We do not fill them in.
Mar 2023
Later-stage VC
Undisclosed
PitchBook records a completed later-stage round. No post-money we will quote.
17 Sep 2026
Agreement to be acquired
Undisclosed
S&P Global said the deal is not expected to be material to its results. That sentence is aimed at S&P shareholders. For you it means the price was not large relative to S&P, not that your unvested equity is safe or worthless. Ask counsel.
What should change your mind
- Deal not described as closed in every database. Your offer may be pre-close or post-close. The benefits, the option plan, and the employer of record change across that line.
- Undisclosed price. You cannot value an option against a blank.
- Services culture inside a public parent. Utilisation, conflicts, and a slower ship cycle are the ordinary result. Sometimes that is what you want.
- Solana versus the Ethereum brand. A principal seat on Solana can be a growth bet or a rounding error. Get it in writing.
Ask them
- Has the S&P transaction closed, and who is the employer of record on the offer?
- What happens to unvested equity, and is there a retention grant?
- Does Security Services stay independent of Ratings engagements?
- For Solana: is the library a funded roadmap or a single seat?
- Worldwide remote, on the researcher posting, means which employment entities and which tax setups?
Sources
If a figure is not in those sources, it is not in this brief on purpose.
What the employer actually wrote
Employer stated. Senior blockchain security developer on OpenZeppelin’s Canton library: Daml contracts, reference implementations, and CIP standards with Digital Asset. Not the Ethereum audit practice and not the Solana principal seat.
- Own features of the OpenZeppelin Contracts Library for Daml end to end, from design through audit: examples include a Timelock, access control, vaults, or token standard support.
- Design and implement components of the year-1 Reference Implementations: privacy-preserving DEX, lending protocol, cross-chain stablecoin settlement, and confidential auction launchpad.
- Implement and shepherd the OZ Daml versions of CIP-56, CIP-86, CIP-103, future CIPs. Coordinate with Digital Asset on spec evolution and with ChainSafe on middleware alignment.
- Present and defend your designs in technical discussions with Digital Asset, the Canton Foundation, and other partners.
- Work with OpenZeppelin's security researchers on threat models, audit preparation, and fixes for the components you own.
Source: the employer’s public Greenhouse record, job 7742510003. Open the original. First seen by this desk 2026-10-06. Nothing above the fold is a substitute for that page.
A reading of the work
Blockchain Lab analysis. These lines are a reading of the advertisement. They are not extra hiring requirements.
- If you cannot explain what a Canton party sees, you are not this hire.
- The buyer is S&P. Ask whether a Canton library is a product or a slide.
- Privacy in the posting means selective disclosure, not anonymity.
Still not disclosed
- Compensation, unless a figure appears in the header. None of these eighteen postings stated one.
- Closing date, and the day the role was first published. The board timestamp is an update.
- Which countries may apply. “Remote” alone is not worldwide eligibility. If the employer wrote “worldwide”, that sentence is theirs — still ask which entity can hire you.
- Visa sponsorship, on-call, and the employing subsidiary.
Not a recommendation to apply. Not an employer assessment. Figures from public reporting move, and a database is not a filing. How this desk labels evidence. Report a listing.
OpenZeppelin · Remote · pay not disclosed
Apply