To see what one of the less obvious DeFi jobs, risk manager, involves, look at what happened at Aave, the largest lending protocol, in the spring of 2026. On 6 April Omer Goldberg, founder of Chaos Labs, announced on X that his firm was leaving Aave after more than three years. He said Chaos had operated at a loss for the past three years, and The Block reported a 2025 budget of $3 million against the $8 million Chaos estimated as the minimum to oversee Aave V3 and V4. On 7 April LlamaRisk, a 16-person firm already working for Aave since 2024, said it would absorb the work. It was the second time in just over two years that Aave lost a risk manager: Gauntlet had left on 21 February 2024.
That episode says more about the trade than any list of titles. The work that is truly specific to wallet.">decentralised finance is deciding how much someone may borrow against what, and saying no when the numbers do not hold. At Aave, as at many protocols, it is done by small outside firms paid through a DAO vote, with a budget that token holders can cut or reject.
This lesson covers six roles: DeFi analyst, risk manager, protocol developer, auditor, strategist in a fund and business development. For each one: what the job is day to day, the skills that postings ask for, and pay with its source and date. No public pay survey of DeFi alone exists, so every figure here is a job-post range or an aggregator estimate, and we say which.
What DeFi jobs look like in October 2026
The general picture of crypto work (the main roles, salaries by region, token grants, vesting and the layoffs of 2022) is in our guide to blockchain jobs and salaries, the first lesson of this careers path. This lesson goes further into one corner of it. If lending pools, decentralised exchanges and stablecoins are still vague, start with our explainer on what DeFi is.
The sector is large in money and small in people. As of 27 October 2026, DefiLlama counted $48.2 billion of staking or liquidity, measured at current market prices. It is the main size metric in DeFi.">value locked on Ethereum, by far the biggest chain, ahead of Base ($6.0 billion), Solana ($5.7 billion) and BNB Chain ($5.5 billion). Lido held $22.35 billion, Aave V3 $16.38 billion and Morpho Blue $11.26 billion on the same day. Those sums are managed by teams that would fit in one office floor: Gauntlet described itself as a 60-person team when it left Aave in 2024, and LlamaRisk counted 16 full-time staff in April 2026.
Value locked (TVL) is a rough measure: prices move it and some deposits are counted twice. How to read it properly is the subject of a later lesson of the DeFi course.
Employers fall into four groups. Protocol teams such as Aave Labs, Morpho Labs or Uniswap Labs write and maintain the code. Service firms sell risk, audit or research work to DAOs. Funds put capital into DeFi strategies. And exchanges, banks and fintechs build DeFi products of their own: on web3.career’s DeFi board in October 2026, Bitpanda and OKX advertised next to native protocols such as Kamino. Most seats are remote, most ask for prior crypto experience, and most are in US dollars.
DeFi analyst: research, dashboards and memos
A DeFi analyst watches protocols and tells a team what to do about them. The most detailed public description we found is Gauntlet’s own “DeFi Analyst” posting, copied on the Working Nomads board, now expired and shown as posted about a year ago. It lists four blocks of work: tracking yield strategies, protocol developments and incentives across chains; due diligence on protocols (solvency, oracles, governance, security); dashboards on incentive rates, TVL changes and vault metrics; and launching and monitoring vaults, including oracle settings, liquidation loan-to-value limits (LLTVs) and multisig set-ups.
The requirements are just as concrete. Gauntlet asked for one to three years of crypto-native research, strategy or trading; comfort reading Solidity or Vyper, without having to audit it; fluency with on-chain data tools such as Dune and subgraphs, plus Python or JavaScript for quick analysis; and a record of memos that changed a deal or a product decision. It did not mention a degree.
A typical week of an analyst looks like this. Monday, a governance proposal wants to raise the borrow cap of a new collateral token: the analyst pulls the token’s on-chain liquidity, checks how much could be sold in a crash without moving the price too far, and writes a recommendation. Wednesday, an incentive programme ends and deposits leave: a dashboard shows where they went. Friday, a competitor launches a vault with a higher yield, and someone has to explain where that yield comes from and what risk pays for it.
The tools are mostly free. Dune lets anyone query indexed blockchain data in SQL and publish dashboards. DefiLlama gives TVL, fees, volumes and a hacks database through a free API, which we used for every market figure in this lesson. Subgraphs (The Graph) expose a protocol’s own events. Token Terminal adds revenue and fee metrics, with a paid tier. An analyst who can write a correct SQL query, read a contract’s events and turn both into a one-page memo already has the core of the job.
What separates a good analyst is judgement about incentives. A yield is a price paid by someone: borrowers, traders, token emissions or risk. The analyst’s job is to name the payer.
Risk manager: the job that is specific to DeFi
A lending protocol such as Aave lets anyone deposit one asset and borrow another against it. Somebody has to set the rules: how much can be borrowed against each collateral, at what point a position is liquidated, what bonus liquidators earn, how interest rates rise as a smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool empties, which price feed each market trusts, and whether a new token may be listed at all. Those are risk parameters, and changing them is a full-time job.
LlamaRisk’s statement to the Aave community of 7 April 2026 said it was ready to absorb Chaos Labs’ functions in full and listed them: automated supply and borrow caps, interest-rate settings, liquidation parameters, E-Mode configuration, oracle design and sanity checks, risk oracle infrastructure, evaluation of new assets and chains, Risk Steward operations, the risk design of Aave V4, the coverage method of Aave’s Umbrella safety module, and market monitoring with alerts. Read as a list of tasks, that is the job description of a DeFi risk team.
Aave and its three risk managers since 2020
Gauntlet worked as Aave’s independent risk manager from 2020. On 21 February 2024 its co-founder John Morrow posted “Gauntlet is leaving Aave” on the governance forum. The key sentence was plain: “Gauntlet is no longer able to continue our work with Aave.” He wrote that almost everyone on Gauntlet’s 60-person team had contributed to Aave. In Gauntlet’s account, the causes were inconsistent guidelines and unstated goals from the largest stakeholders, duplicate governance proposals, criticism of its role in distributing ARB incentives, and claims that its research team’s work for other protocols was a conflict of interest. Those are Gauntlet’s reasons; several Aave contributors disputed them in replies on the same forum thread.
Chaos Labs had priced every loan on Aave since 2022, according to The Block, which called it Aave’s top risk manager. Its exit on 6 April 2026 came with a public dispute about money and method. Goldberg wrote that “the engagement no longer reflects how we believe risk should be managed”, as quoted by The Block. Aave Labs’ chief executive Stani Kulechov gave his side, as reported by Cointelegraph on 7 April: Aave had offered to double the payment to $5 million; Chaos had pitched becoming the sole risk provider, which would have pushed out LlamaRisk; and it wanted Aave to use its own price oracles instead of Chainlink’s, which Aave declined.
LlamaRisk then took over with Aave Labs. In an update of 9 April, it said the Risk Council multisig, which can apply some changes quickly, had passed from Chaos Labs and BGD Labs to a two-of-two set-up between Aave Labs and LlamaRisk. Chaos Labs’ automated risk oracles had stopped updating after 8 April, and LlamaRisk said it was building protocol-owned risk oracles on Chainlink’s Runtime Environment. LlamaRisk added that the scope needed “a substantially larger budget than our current engagement” and promised a renewal proposal; we found no later public figure.
For a job seeker, the episode is a description of the trade. Risk work in DeFi is mostly a service contract, renewed by token-holder vote, and the margins can be thin: Chaos Labs said it lost money for three years on the largest client in the sector. Conflicts of interest come with it too. Gauntlet’s post complained that its research for other protocols was called “moonlighting for direct competition”, while noting that Chaos Labs worked for several Aave forks.
Morpho vault curators, the other risk career
After Aave, Gauntlet moved into a different model: curating vaults. On Morpho, a curator decides which lending markets a vault may use, sets exposure limits by collateral, oracle or protocol, and sets the vault’s performance and management fees, according to Morpho’s documentation. Depositors keep using the vault’s smart contracts; the curator writes the risk policy. Gauntlet said on 25 June 2026 that it curated over $1.5 billion in supplied assets across its vaults, and that they were now offered through Elwood, which it describes as an FCA-regulated, London-based institutional platform.
That gives three doors into risk work: inside a protocol team, at a curator that runs vaults, or at a risk firm that sells modelling to several clients. All three want statistics, Python, simulation of liquidations under price shocks, a precise understanding of price oracles and bad debt, and one skill that is easy to underestimate: arguing in public on a governance forum, in writing, with numbers.
Protocol developer: smart contracts that hold other people’s deposits
The developer track is covered step by step elsewhere in this path: the languages and the choice of chain in our guide to becoming a blockchain developer, the basics of contracts and tests in our hands-on Solidity lesson, and a first deployed application in the lesson on building your first dApp, which comes just before this one.
What changes in DeFi is the cost of a mistake. A protocol developer writes code that holds deposits from strangers and talks to other protocols it does not control. The daily concerns are composability (your vault calls a lending market that calls a price feed), oracle integration, upgrade and admin-key design, rounding and accounting errors, and tests that try to break invariants such as “total borrowed never exceeds total supplied”. Senior teams add fuzzing and formal verification.
The hiring signal for October 2026 is a short list of senior roles. On web3.career’s DeFi board, Global Settlement Network posted a Senior Protocol Engineer (Move VM) role at $120,000 to $240,000, and Mysten Labs a Security Engineer at $140,000 to $190,000. Morpho Labs posted a Senior Protocol Engineer role on 2 May 2026, in Paris or remote within a band of time zones, now closed. It showed no figure, only that pay is benchmarked at the 90th percentile of base salaries via the Pave compensation tool, plus MORPHO token grants, and it asked for a master’s degree in a quantitative field or equivalent, five years of software architecture and two years of blockchain research and development. Junior protocol roles are rare on these boards.
Smart contract auditor and security researcher
Auditors read code they did not write, looking for the path that drains it. The demand is visible in the losses. DefiLlama’s hacks database listed 312 incidents dated 2026 as of 27 October, totalling about $2.37 billion, against 148 incidents and about $2.72 billion for all of 2025. The database also counts centralised exchanges and wallets: the biggest 2026 case is the Bitget hot wallet ($387 million, 24 September). Among DeFi protocols, it lists Drift ($295 million on 1 April, a hijacked proxy upgrade), Kelp ($293 million on 18 April, spoofed cross-chain messages) and Tectonic ($124.5 million on 30 August, a share-accounting attack). Why code is attacked, and how, is explained in our guide to whether a blockchain can be hacked.
The work happens in three settings. Audit firms staff private reviews with a lead and a few researchers. Contest platforms open a codebase to hundreds of researchers for a fixed period and split a prize pool among those who find valid issues. Bug bounties pay for flaws found in live code.
The platforms are changing fast. Code4rena, which made contest auditing popular, announced on 13 May 2026 that it would wind down, The Block reported, with Immunefi taking over its bug bounty customers and, according to the same report, its researchers. Sherlock now sells collaborative audits, contests, bug bounties and an AI-based “Audit Engine”, with an update posted on 21 October 2026; it claims over 11,000 registered researchers and more than 1,500 audits, figures it publishes itself. Cantina now calls itself an agentic security platform, and presents its on-chain service as Spearbit’s researchers combined with AI-native review. We do not predict what AI does to entry-level audit work; we note that both platforms put it on their front pages in October 2026.
Pay is the least documented part. We found no reliable public survey of auditor income, and none of the platforms we checked publishes payout totals for researchers. One employer range exists: a Spearbit “Security Researcher” posting, remote, now closed and shown as posted more than six months ago, offered $100,000 to $150,000 a year plus equity. It asked for deep familiarity with Solidity and EVM behaviour, knowledge of bug classes such as reentrancy and access control, clear written reports, and credibility from audits, capture-the-flag games or bug bounties. Contest income is irregular: a few researchers earn a lot, most earn little, and the platforms do not publish the spread.
DeFi strategist and portfolio roles in funds
A strategist at a fund or a treasury puts capital into DeFi positions: lending, liquidity provision, staking, structured yield. The job is investment work: due diligence on a protocol’s code history, its token incentives, its liquidity if everyone leaves at once, its governance and its admins. Then position sizing, monitoring and a written case for every allocation.
Public postings are rare and say little about pay. One example, listed on the job board of the venture fund Framework Ventures, is a “DeFi Analyst” role at the staking protocol Swell Network (closed, posted more than six months ago). It described deal analysis, investment memos and portfolio monitoring, and asked for one to four years in venture capital investment, trading or DeFi development, plus a bachelor’s degree or higher with a technical background. It showed no salary.
We could not confirm any dated pay figure from a named fund, so we give none. These seats are few, senior and often tied to performance. Nothing in this lesson is investment advice.
Business development, legal, product and other non-code roles
Most DeFi job ads are not for engineers. web3.career listed 7,628 jobs under its DeFi tag in October 2026, a tag loose enough to include exchanges and consultancies. The first page alone held business development, legal, design, product, recruiting and sales roles.
Business development in a protocol means integrations (getting a wallet, an exchange or another protocol to plug in), onboarding new collateral assets with the risk team, designing liquidity incentives, and relationships with DAOs, market makers and institutions. Skills asked for: selling, reading tokenomics well enough to spot a bad deal, and writing proposals that a governance forum will accept. Lawyers and compliance staff in DeFi work on token design, sanctions screening and the rules of each market; product managers translate risk parameters into screens a user can understand.
What DeFi jobs pay: dated ranges and their limits
Read these numbers with care. They are ranges posted by employers or estimates from job boards, in US dollars, mostly for remote roles open to the United States. They show base salary only: token grants, bonuses and equity come on top and can be worth a lot or nothing. No survey of DeFi pay exists that we could find; the crypto-wide compensation surveys are discussed in the earlier lesson on blockchain jobs.
| Role | Annual pay (USD) | Source and date | Type |
|---|---|---|---|
| DeFi analyst (Gauntlet), remote US and Canada | 165,000-205,000 + bonus and equity | Gauntlet posting, Working Nomads copy, expired (about a year old as of October 2026) | Employer range |
| DeFi developer, entry (0-2 years) | 130,000-165,000 | crypto.jobs, updated October 2026 | Estimate, salary data in 11 of 80 postings |
| DeFi developer, mid (3-5 years) | 170,000-220,000 | crypto.jobs, October 2026 | Estimate |
| DeFi developer, senior (5+ years) | 230,000-270,000 | crypto.jobs, October 2026 | Estimate |
| Senior protocol engineer, Move VM (Global Settlement Network) | 120,000-240,000 | web3.career, October 2026 | Posted range |
| Security engineer (Mysten Labs) | 140,000-190,000 | web3.career, October 2026 | Posted range |
| Security researcher (Spearbit), remote | 100,000-150,000 + equity | Framework Ventures board, closed, posted 6+ months before October 2026 | Employer range |
| Senior business development (Kamino) | 160,000-220,000 | web3.career, October 2026 | Posted range |
| Head of business development (Kamino) | 126,000-180,000 | web3.career, October 2026 | Posted range |
| General counsel (Kamino) | 157,000-158,000 | web3.career, October 2026 | Posted range |
| Lead product manager DeFi (Bitpanda) | 114,000-148,000 | web3.career, October 2026 | Posted range |
| Business development lead, AI (Monad Foundation) | 98,000-147,000 | web3.career, October 2026 | Posted range |
Two cautions on the table. The crypto.jobs estimate says it combines industry benchmarks with posting data, and only 11 of the 80 postings it counted showed a salary; its own text gives a slightly different junior range ($130,000 to $160,000). The web3.career ranges are single job ads, not averages.
United States and remote roles
Nearly every DeFi job ad with a salary in our sample was written for workers in the United States or remote workers in US time zones. That makes US figures the only ones with a reasonable number of data points, and even those are a handful of ads, not a survey.
United Kingdom: almost no DeFi ads
The UK market for jobs tagged DeFi has nearly disappeared from job boards. ITJobsWatch found 6 permanent UK vacancies citing DeFi in the six months to 27 October 2026, 7 in the same period of 2025 and 61 in 2024. Only two of the 2026 ads gave a salary (median £130,000), too few to treat as a market rate. The skills cited most often alongside DeFi were Ethereum and smart contracts (5 ads of 6), then Solidity, fintech and Java (4 each).
France and Italy: no DeFi-specific pay data
We found no public salary data for DeFi roles in France or Italy, from surveys, recruiters or job boards. Generic analyst or blockchain-developer figures exist, but they are not about DeFi and we do not use them here. Readers in Europe mostly apply to remote roles paid by foreign employers, in dollars or euros; Morpho Labs is one DeFi protocol team that has advertised roles in Paris.
How to become a DeFi analyst, step by step
The postings above share one fact: “entry level” in DeFi still asks for one to three years of crypto experience. Gauntlet asked for one to three years, the Swell Network role for one to four, Morpho Labs’ senior role for far more. The way around that wall is public proof of work, built before the first application.
- Learn how lending pools, decentralised exchanges and stablecoins work, then use them with small test amounts on a testnet so the mechanics are not abstract.
- Open DefiLlama and a block explorer every day for a month and write down what changed: which pools grew, which incentives ended, which protocol was hacked.
- Learn SQL, then publish three Dune dashboards on questions nobody has answered well, such as who supplies a given lending market or where liquidations happen.
- Read a governance forum for a month. Pick one real decision, for example the Chaos Labs exit and the LlamaRisk takeover at Aave in April 2026, and write a one-page memo with numbers.
- Learn enough Solidity to read a contract’s functions and events; the security basics in our Solidity lesson are the minimum.
- Apply with links: the dashboards, the memos and any forum posts. For security roles, add audit contest reports or bug bounty findings.
None of this guarantees an offer. It does answer the first question a hiring manager asks: what have you already analysed, and was it right?
Rules that matter for DeFi workers in the US, UK and EU
In the United States, the legal risk for people who build DeFi software has been an open question for years. At an SEC roundtable on 9 June 2025, Chairman Paul Atkins said he had asked staff to study a conditional exemption he called an “innovation exemption”, and that “Engineers should not be subject to the federal securities laws solely for publishing this type of software code.” That was a speech, not a rule; as of October 2026 we found no final exemption published.
British institutional clients tend to reach DeFi through firms the FCA supervises: Gauntlet’s vaults, for instance, are offered through Elwood. On both sides of the Atlantic, tokens received as pay are taxed as income, by HMRC in the UK and by the IRS in the US: see our guide to crypto taxes in the United States and the UK version.
Across the EU, MiCA is the main crypto law. France’s market regulator AMF published a discussion paper on DeFi on 19 June 2023, arguing for a progressive, proportionate approach and the principle “same activity, same risk, same regulation”. How MiCA treats crypto-asset service providers, and where decentralised services sit, is explained in our guide to MiCA.
The next lessons of the DeFi course go back to the basics: what you need to know before you start, the history of DeFi, its stack of protocols and how to measure it. Each will be linked here once published.
