Vulnerability Research Engineer

An early engineer on Socket Security's patching work, building the infrastructure that ships secure, vetted versions of open source packages to developers, working remote-first with quarterly off-sites. The engineer leads patches for high-impact vulnerabilities in npm packages, helps decide which patches matter most, scales output to dozens or hundreds a week, and builds automated detection, patch generation, testing and delivery systems and APIs, working with security researchers on critical flaws.

Socket asks for three years of production software engineering, strong Node.js, JavaScript and TypeScript, deep familiarity with npm, yarn or pnpm, an understanding of vulnerability management, and API and data pipeline experience; other package ecosystems and open source maintenance help.