Security Engineer - Node.js Proactive Defense (worldwide remote, work anywhere)

What you'll own

• The product. A brand-new product line, yours to define — what we intercept, what we don't, what the customer-visible surface looks like.
• The technical approach. Instrumentation strategy, deployment shape, programming language — all open. You'll consult with our architects but the direction is yours.
• Implementation, end to end. You'll have the full tooling stack we provide — LLM subscriptions, modern dev infrastructure, the works. Use what makes you fast.
• Methodology. How you build conviction in your detection logic — your call.
• Cross-layer signal. Our existing stack produces threat intelligence at unmatched scale: tens of millions of monitored sites, petabyte-scale malware sample storage, real-time domain and URL reputation, IP-level attack feeds. These are available for you to plug into. Use what helps.

How we'll measure success

The product is held to four numbers: runtime overhead, false positives, false negatives, and customer-escalation volume. They reflect what hosting providers and their customers care about. Hit them well and the product runs inside a meaningful slice of the modern Node.js web.

What we're looking for

An experienced researcher or engineer who can build and iterate on a brand-new product, driving both the research and the development. The hard part of this work is knowing what's malicious, what's vulnerable, and what's just an unusual but legitimate pattern — and being right about it across the long tail of frameworks, libraries, and customer code we'll encounter in production.

Requirements

Must have:

• Familiarity with the Node.js runtime and the JavaScript ecosystem.
• Strong web application security fundamentals and current knowledge of practical exploitation.
• A working sense of how detection rules behave at scale — what catches attackers without flagging the long tail of legitimate code.