Application Security Engineer

Saltmarsh keeps passwords, recovery codes and the Wi-Fi password for grandma's house in one place, shared the right way across a family. We have 900,000 users and a security model where we can't read anything they store.

You'll be our second dedicated security engineer. Within 90 days you'll run threat modelling for the new emergency access feature, take over our bug bounty triage (about 40 reports a month), and work with the client teams on hardening the browser extension's autofill. Our clients are TypeScript and Rust compiled to WebAssembly, using WebCrypto and libsodium.

We're spread from California to Berlin. Security reviews are written and asynchronous, with a weekly 45-minute sync. We publish our audit reports and expect you to help write the next one.