ВеликобританияBackend Engineer (Security)
3 нед. назад
ВеликобританияRemote
backendsecuritysandboxingproduct_engineeringoffensive_security
Backend product engineer focused on security to build secure sandbox runtimes for running untrusted user code safely at scale.
О компании
- is the platform for running reliable AI agents and workflows. Developers use it to build, deploy, and scale production systems with built-in tools for orchestration, scheduling, monitoring, and debugging.
- Our Cloud product is a managed service where we deploy our users' code and auto-scale from zero to millions of executions. Today, we serve thousands of teams building AI apps and agents, handling hundreds of millions of executions per month.
- We're looking for a backend product engineer who loves security - not a security box-ticker. You'll build and own the systems that let Trigger safely run massive volumes of untrusted user code inside our infrastructure, at scale.
- Some of our customers let their own users run untrusted code on top of Trigger - think coding agents executing arbitrary instructions. We have to guarantee that code can never break Trigger's systems, or our customers' systems. That makes this partly a product engineering role: building secure sandbox runtimes is a feature we ship, not something bolted on after the fact.
- The ideal person here is a backend engineer with genuine offensive-security instincts - someone who naturally gravitates toward hacking, pen testing, and breaking things, and brings that curiosity into how they build. You'll pair strong backend/product instincts with a hacker's mindset.
- We are proud to be open source - we believe in the open source community and building a great free-to-use product.
- We ship uncomfortably fast - as a startup, moving fast is key. We are pragmatic about what we build, when we build it.
- Working autonomously - we don't tell you what to do. We decide as a team what will have the biggest impact for our customers and prioritise from that.
Обязанности
- You'll do a variety of things including:
- Sandbox and runtime security. Designing and maintaining the secure execution environments that isolate untrusted user code - the core, product-shaped problem at the heart of this role.
- Threat detection and incident response. Building monitoring and alerting for suspicious activity, and leading the response when something needs investigating.
- Vulnerability management, end to end. Regular scanning and triage, plus AI-assisted security scans run on a quarterly cadence, and triaging incoming disclosures.
- Offensive security. Running internal, AI-assisted pen testing, and potentially bringing in external firms for deeper engagements.
- PR security review. Adding a security-specific review layer on top of our normal PR process.
- SOC 2 and compliance. Mostly done already - this is about ongoing maintenance, not standing it up from scratch.
- Vulnerability disclosure process. Owning our vulnerability disclosure program end to end.
- Security culture. Helping the wider engineering team build secure habits - reviews, documentation, and pragmatic guardrails rather than heavy process.
- Working at a Commercial Open Source Software company is more than just security work:
- We have an active community on Discord and GitHub. Everyone on the team helps customers, reviews PRs, and creates issues.
- Having great documentation is essential. Everyone writes docs.
- We're a product-led growth company, so everyone is expected to get involved in creating content like code examples, blog articles, videos, and tweets.
Требования
- Real backend engineering experience. You can design and ship production backend systems, not just audit someone else's.
- Genuine offensive-security curiosity. Pen testing, CTFs, bug bounty hunting, or hacking as a hobby or discipline - this isn't a checklist role.
- Comfort owning ambiguous, product-shaped security problems. Sandboxing and runtime isolation are engineering problems as much as they are security ones.
- A proactive mindset. This role should take work off the team's plate, not create a queue for others - we're not looking for a security box-ticker.
- Comfortable being on call. Reliability and security response are shared responsibilities across the team.
- Open to in-person events throughout the year. If you're remote, we'll arrange these so the team gets real time together.
- You'll be an amazing fit if you have:
- Experience building or hardening sandboxed/isolated execution environments (containers, microVMs, gVisor, Firecracker, WASM sandboxes, or similar).
- A track record in pen testing, bug bounty programs, or CTFs.
- Experience using AI-assisted tooling for security scanning or workflows.
- A proven track record of contributing to open source projects.
- Worked at a developer tools, infrastructure, or open source company.
- Experience with Node.js and TypeScript, enough to read and review application code.
Условия
- Generous, transparent compensation and equity - we hire the best talent and pay to reflect that. We also offer equity so everyone is invested in the company's success.
- Async working - need a heads-down day or meeting-free days to stay productive? No problem!
- Home office - we help provide equipment for a comfortable setup so you're as productive at home as you are in the office.
- Generous vacation - 25 days vacation excluding national holidays, plus sick leave and generous parental leave.
- Training budget - an annual budget to contribute towards learning, such as books, an Audible subscription, or online courses.
- Pension contributions - enroll in our company pension scheme, or we'll contribute directly to your private pension.