Bug Bounty Triager / Security Analyst

About Spearbit & Cantina:

We're building Cantina, an AI Security Platform that secures the world's code. Originally the "GitHub for Security" — connecting security researchers with the projects needing their expertise — Cantina has evolved into a multi-product platform spanning Apex, Clarion, and Cantina Bounties. It has powered major competitions and serves many of the leading projects in Web3, supporting collaborative security reviews, public and private competitions, bug bounty programs, AI-driven code analysis, and a security operations center (SOC) that monitors, triages, and responds to live alerts and threats.

Similar to how cloud-security startups emerged previously, Cantina aims to be the definitive code-security platform for the future.

The Opportunity:

We’re looking for a Bug Bounty Triager / Security Analyst to join our team. In this role, you’ll be the first line of defense in reviewing vulnerability submissions, ensuring both speed and technical accuracy. Your work will help maintain the integrity of Cantina’s bounty ecosystem, foster trust between projects and whitehats, and raise the bar for security practices across the industry.

Candidates must be willing to work U.S. Eastern or Pacific hours.

What you'll do:

• Review, reproduce, and validate incoming vulnerability reports across smart contracts, DeFi protocols, and blockchain systems.
• Assess severity and impact in the context of each project’s unique architecture and threat model.
• Communicate with researchers to clarify missing details and provide constructive feedback on invalid or incomplete submissions.
• Write clear and concise summaries for each validated report, including reproduction steps, impact analysis, and recommended mitigations.
• Partner with Cantina’s program managers to ensure smooth workflows between security researchers, project teams, and internal stakeholders.
• Contribute to the design and continuous improvement of Cantina bounty programs, workflows, and tooling.
• Support other Cantina Security services that require triaging expertise.
• Serve as a trusted bridge between projects and whitehats, balancing fairness, transparency, and accuracy in outcomes.

What we’re looking for:

• Prior experience in a full-time professional role is required.
• Strong foundation in smart contract security, including common vulnerability classes and exploitation techniques.
• Ability to read and analyze Solidity and other EVM-compatible languages; familiarity with Rust-based blockchains (e.g., Solana, Substrate) or other blockchain infrastructure.
• Experience reviewing code bases, identifying vulnerabilities, and reproducing exploits.
• Understanding of DeFi mechanisms (e.g., AMMs, lending protocols, bridges) and ability to quickly learn new protocol designs.
• Familiarity with vulnerability disclosure workflows and bug bounty ecosystems.
• Excellent written communication: able to explain technical issues clearly, neutrally, and with professionalism to both security engineers and non-technical stakeholders.
• Detail-oriented and organized, able to manage a steady flow of incoming reports while maintaining high accuracy.

Benefits

• Competitive salary and performance-based compensation opportunities
• Opportunity to work in an early-stage startup with a talented and passionate team
• Exposure to high-profile clients in the blockchain and cryptocurrency industry

Join Cantina and help us build the future of code security!