ABOUT CONSENSYS
Consensys Incorporated is an independent blockchain infrastructure company, spun out of Consensys Software Inc. — one of the world's leading blockchain technology companies and the primary development organization behind the Ethereum ecosystem.
We build and operate neutral, institutional-grade blockchain infrastructure that connects banks, asset managers, custodians, and financial market infrastructures to digital asset networks, meeting the non-negotiable standards of institutional finance: privacy, scalability, resilience, security, and regulatory readiness.
Headquartered in Miami, Florida, and operating across the US, Europe, and Australia, Consensys Incorporated launched as an independent entity in September 2026 and is building the team to match its ambition.
WHY THIS ROLE EXISTS
Following Consensys's strategic transition into two independent entities (MetaMask for consumer platforms and Consensys focusing on protocols and institutional infrastructure), we are seeking an experienced Security Operations Center (SOC) Analyst to join our security organization. Consensys powers the core infrastructure driving the decentralized web, including Linea mainnet and the open-source Lineth ZK rollup stack recently donated to Linux Foundation Decentralized Trust. The SOC Analyst will be responsible for architecting, building, and operating a comprehensive 24/7 monitoring and alerting ecosystem across our entire digital asset footprint.
This role spans enterprise IT SaaS environments, core blockchain infrastructure, and Web3 smart contract security. The SOC Analyst will bridge traditional cybersecurity operations with cutting-edge Web3 threat detection, protecting our corporate IT stack (JumpCloud, AWS, Google Workspace, GitHub, Notion, Zoom), Linea mainnet infrastructure, and ecosystem DeFi protocols against emerging cyber threats and exploits using tools such as Hypernative, Hexagate, and Blockaid.
WHAT YOU’LL OWN
1. Enterprise IT Security & SaaS Monitoring
- Architect and maintain centralized log collection, SIEM integration, and incident response services across AWS (utilizing Amazon GuardDuty and AWS CloudTrail) and corporate IT services including JumpCloud, Google Workspace, GitHub, Notion, and Zoom.
- Develop custom detection rules and alert logic to detect unauthorized access, privilege escalation, credential compromise, and anomalous user activity.
- Ensure complete security logging visibility, audit readiness, and access control management across all corporate platforms.
2. Infrastructure & ZK-Rollup Monitoring (Linea & Lineth)
- Establish real-time security monitoring for Linea mainnet and the open-source Lineth ZK rollup stack (including Besu execution layer, Maru consensus, coordinator, and provers).
- Monitor RPC endpoints, sequencer performance, L1/L2 messaging reliability, state root finalization, and infrastructure telemetry.
- Collaborate with the DevOps team and core engineering teams to detect and mitigate infrastructure threats, DDoS attacks, and zero-day vulnerabilities.
3. Web3 & Smart Contract Threat Detection
- Implement and tune real-time Web3 threat monitoring platforms including Hypernative, Hexagate, and Blockaid.
- Build automated alerts to detect suspicious smart contract interactions, flash loan attacks, reentrancy exploits, liquidity drains, and unauthorized bridge activity on Linea mainnet.
- Perform onchain forensics and transaction trace analysis to safeguard ecosystem DeFi protocols and institutional assets.
4. Incident Response & Threat Hunting
- Serve as a primary responder for security alerts originating from IT SaaS, cloud infrastructure, and Web3 protocol layers, utilizing Grafana Cloud IRM to manage on-call rotations and incident management.
- Lead triage, investigation, containment, and post-mortem root cause analysis for confirmed security incidents.
- Proactively conduct threat hunting across system logs, cloud environments, and onchain transaction streams.
5. Security…