Compensation
- Full-time
- $185k–$240k / year
- Part-time
- $105–$140/hr · 15–25 hrs / week
- Advisory
- $1,050–$1,400/day · 1–4 days / month
15–25 hours a week. Billed hourly.
Day rate for reviews, working sessions, and office hours. Typical cadence is 1–4 days a month. A monthly retainer is an option in the offer.
All figures are USD cash, remote, with US Eastern overlap. Location and the client brief can move the number. Token or equity only appears if that client has it.
Threat-model, review, and harden the contracts Lootrushs ships — before mainnet, not after an incident.
You sit with protocol engineers, write invariants, and catch what late audits miss. We still use external auditors on larger launches. This seat is the person inside Lootrushs who can block a deploy. You will not run corporate IT or SOC2 as your main job. You will sit with protocol engineers while they can still change the design. Expert-level familiarity with EVM exploit classes is required; a PDF-only background is not enough.
How hiring works
Roles are posted by Lootrushs as full-time, part-time, or advisory — pick one on the form. We source, screen, and interview — or a client introduces a candidate to us. After you pass our process, you may interview with the client company. If both sides agree, you join through Lootrushs and work on that client’s product.
What you will do
- Review contracts, upgrade paths, and admin powers before they are marked done.
- Run fuzzing, invariant, and differential tests on critical paths.
- Write findings engineers can fix: severity, test, and a suggested patch when you can.
- Define launch checklists and incident playbooks with Ops.
- Join external audit kickoffs with a packet that is not a surprise to us.
- Threat-model BrickFi issuance and client vaults specifically, not only “generic DeFi.”
- Track residual risk after an audit and make sure it is visible to the CTO.
What you bring
- Prior audit, bounty, or protocol security work — with examples you can discuss.
- Expert knowledge of Solidity exploit classes.
- You can write Foundry tests, not only PDF reports.
Nice to have
- Echidna / Medusa
- Formal methods
- Public writeups
- RWA or permissioned tokens