Lead Blockchain Security Developer; Canton

The Canton Network engagement

This role joins us at the start of a 24-month, multi-million-dollar commitment to build the open-source DeFi foundations of the world's most institutional blockchain, approved by the Canton Foundation. The scope includes:

• 8 production-ready Reference Implementations
  . Privacy-preserving DEX, lending protocol, cross-chain stablecoin settlement, confidential auction launchpad, and four more defined in year two. End-to-end blueprints that other teams will fork.
• The Open Zeppelin Contracts Library for Daml
  . The audited foundation Canton developers will import—vaults, hooks, RBAC, credentials, modular multi-sig accounts, standardized messaging gateway, DeFi math, staking, vesting, auctions, and more. The same role our Solidity library plays today, on Canton.
• Canton standards implementation
  . Audited Daml implementations of CIP-56 (Token Standard), CIP-86 (ERC-20 Compatible Interface), CIP-103 (dApp Standard), and CIP-104 (Traffic-Based App Rewards) — designed to interoperate cleanly with the broader Splice ecosystem and with Chain Safe's CIP-86 middleware.
• 55 researcher-weeks of dedicated security capacity
  . Smart-contract audits, full-stack reviews, pen tests—amplified by Open Zeppelin's AI security agent in the workflow. Every release ships with a published audit report.
• AI-native developer experience for a new ecosystem
  . Contracts Wizard, UI Builder, MCP Server, Claude Plugin, AI Skills—all built for Canton, all AI-native end-to-end. You'll help define how AI-native engineering looks on a non-EVM stack.

You will work alongside Digital Asset, the Canton Foundation, and Chain Safe. The deliverables become the standard others build on. The work is public; the impact is measurable; the partners are the institutions reshaping how capital moves. Canton is your first focus, but you'll keep contributing across the broader Secure Development portfolio as the work demands.

Open Zeppelin is a fully remote organization, however candidates for this position must be located within UTC-8 to UTC+3 time zones to be considered.

• Own the development of the Open Zeppelin Contracts Library for Daml end-to-end: vaults, hooks, RBAC, credentials, messaging gateway, accounts, and more. The audited primitives Canton developers will import.
• Lead the technical design and implementation of the year-1 Reference Implementations: privacy-preserving DEX, lending protocol, cross-chain stablecoin settlement, and confidential auction launchpad.
• Implement and shepherd the OZ Daml versions of CIP-56, CIP-86, CIP-103, and CIP-104. Coordinate with Digital Asset on spec evolution and with Chain Safe on middleware alignment.
• Run client-facing roadmap, design, and milestone discussions with Digital Asset, the Canton Foundation, and Chain Safe.
• Collaborate with Open Zeppelin's auditors and security researchers on threat models, audit prep, and full-stack reviews for every Reference Implementation.
• Use AI systems as core daily tools. Extend them: build agents, skills, and workflows that compound the team's leverage on the Canton engagement and beyond.
• Apply AI directly to security work and share what works back to the team: audit assistance, invariant generation, spec analysis, fuzzing harnesses, custom evals.
• Contribute developer-experience and security feedback upstream into the Canton protocol, Splice, the Daml SDK, and the Splice Wallet Kernel.
• Conduct open-ended research around privacy-preserving DeFi, multi-party authorization patterns, and Canton-specific primitives; you'll have time to publish and contribute back to Open Zeppelin's body of knowledge.

• Production Daml fluency
  . You have shipped non-trivial Daml in production. You understand templates, choices, controllers/observers/signatories, multi-party authorization, sub-transaction views, and propose/accept patterns as first-class primitives. Running an SV, contributing to Splice internals, governance, or Canton Coin tokenomics.
• 3+ years of experience in UTXO-based protocol development
  . You can reason about Canton's privacy boundaries the way an EVM developer reasons about storage slots. Prior production work in a…