Vulnerability Research Engineer

Description

The company helps developers and security teams move faster by removing manual security work, and thousands of organizations use it to find, audit and manage open source code.

Customers include Anthropic, xAI, Figma and Vercel. The company was founded by Feross Aboukhadijeh, a long-time open source maintainer whose software is downloaded over a billion times a month, and has raised $125M from angel investors, operators and security leaders.

The team is building and scaling patching infrastructure that delivers vetted, secure packages to developers worldwide. The work sits at the centre of supply chain security: you will write patches for critical vulnerabilities and build systems that help the wider open source ecosystem stay secure.

The role mixes hard technical work with community impact across the ecosystem. As an early team member, you will help decide how this technology expands across JavaScript and beyond.

Responsibilities

• Become fluent in the company's workflows, tools and patching processes
• Lead patching work on high-impact npm vulnerabilities
• Grow patch output to dozens or hundreds of patches a week
• Help choose and rank the most valuable patches
• Advise on patch priority using ecosystem and customer impact
• Build and improve automated patching tools and infrastructure
• Design and implement scalable systems for generating and delivering patches
• Create automated workflows that detect vulnerabilities and produce patches
• Build APIs and integrations that deliver certified packages
• Build tooling to test and quality-check patches
• Partner with security researchers on understanding and patching critical flaws
• Help shape the technical roadmap for growth
• Offer developers fast, safe fixes for widely used packages
• Help secure the software supply chain used by millions of developers

Requirements

• At least 3 years of software engineering experience on production systems
• Strong skills in Node.js, JavaScript and TypeScript
• Experience with npm, yarn, pnpm and the JavaScript ecosystem
• Understanding of software security concepts and vulnerability management
• Experience building and scaling APIs and data processing pipelines
• Familiarity with automated testing, CI/CD and deployment systems
• Nice to have: experience with security tooling, vulnerability scanning or patch management
• Nice to have: knowledge of software supply chain security challenges
• Nice to have: experience with other package ecosystems such as Python, Go or Rust
• Nice to have: open source contributions or package maintenance experience
• Nice to have: background in DevSecOps or security engineering
• Nice to have: experience with high-throughput data processing systems