Backend Engineer (Security) at Trigger in Remote or Hybrid UK

Job description

• Application
• About us
• We're looking for a backend product engineer who loves security - not a security box-ticker. You'll build and own the systems that let Trigger safely run massive volumes of untrusted user code inside our infrastructure, at scale.
• Some of our customers let their own users run untrusted code on top of Trigger - think coding agents executing arbitrary instructions. We have to guarantee that code can never break Trigger's systems, or our customers' systems. That makes this partly a product engineering role: building secure sandbox runtimes is a feature we ship, not something bolted on after the fact.
• The ideal person here is a backend engineer with genuine offensive-security instincts - someone who naturally gravitates toward hacking, pen testing, and breaking things, and brings that curiosity into how they build. You'll pair strong backend/product instincts with a hacker's mindset.

Responsibilities

• Sandbox and runtime security. Designing and maintaining the secure execution environments that isolate untrusted user code - the core, product-shaped problem at the heart of this role.
• Threat detection and incident response. Building monitoring and alerting for suspicious activity, and leading the response when something needs investigating.
• Vulnerability management, end to end. Regular scanning and triage, plus AI-assisted security scans run on a quarterly cadence, and triaging incoming disclosures.
• Offensive security. Running internal, AI-assisted pen testing, and potentially bringing in external firms for deeper engagements.
• PR security review. Adding a security-specific review layer on top of our normal PR process.
• SOC 2 and compliance. Mostly done already - this is about ongoing maintenance, not standing it up from scratch.
• Vulnerability disclosure process. Owning our vulnerability disclosure program end to end.
• Security culture. Helping the wider engineering team build secure habits - reviews, documentation, and pragmatic guardrails rather than heavy process.

Requirements

• Real backend engineering experience. You can design and ship production backend systems, not just audit someone else's.
• Genuine offensive-security curiosity. Pen testing, CTFs, bug bounty hunting, or hacking as a hobby or discipline - this isn't a checklist role.
• Comfort owning ambiguous, product-shaped security problems. Sandboxing and runtime isolation are engineering problems as much as they are security ones.
• A proactive mindset. This role should take work off the team's plate, not create a queue for others - we're not looking for a security box-ticker.
• Comfortable being on call. Reliability and security response are shared responsibilities across the team.
• Open to in-person events throughout the year. If you're remote, we'll arrange these so the team gets real time together.
• Experience building or hardening sandboxed/isolated execution environments (containers, microVMs, gVisor, Firecracker, WASM sandboxes, or similar).
• A track record in pen testing, bug bounty programs, or CTFs.
• Experience using AI-assisted tooling for security scanning or workflows.
• A proven track record of contributing to open source projects.
• Worked at a developer tools, infrastructure, or open source company.
• Experience with Node.js and TypeScript, enough to read and review application code.

Skills

Required

• Backend engineering
• Offensive security curiosity
• Pen testing
• CTFs
• Bug bounty hunting
• Hacking
• Product engineering
• Security
• On-call responsibility

Preferred

• Pen testing, bug bounty programs, CTFs
• AI-assisted security scanning
• Open source contribution
• Node.js and TypeScript

Benefits

• Generous, transparent compensation and equity - we hire the best talent and pay to reflect that. We also offer equity so everyone is invested in the company's success.
• Async working - need a heads-down day or meeting-free days to stay productive? No problem!
• Home office - we help provide equipment for a comfortable setup so you're as productive at home as you are in the office.
• Generous vacation - 25 days vacation excluding national holidays, plus sick leave and generous parental leave.
• Training budget - an annual budget to contribute towards learning, such as books, an Audible subscription, or online courses.
• Pension contributions - enroll in our company pension scheme, or we'll contribute directly to your private pension.