Senior Software Engineer (AppSec)
- Compensation
- Not disclosed
- Location
- Remote or Hybrid UK
- Work setup
- Remote
- Seniority
- Senior
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Senior backend engineer. You design and ship production backend systems yourself.
- AppSec experience. You’ve done hands-on application security work, such as secure code review, threat modelling, pen testing, CTFs or bug bounties. You don’t need a security job title or to have run a
- Cloud operations. You’ve run production systems in the cloud.
- Multi-tenant systems. You’ve built or secured systems where many customers share the same infrastructure.
- TypeScript. You’re comfortable working in it. Our codebase also uses Go and Rust.
- AI-forward. You use AI tools to automate testing, detection, and defense.
- Startup pace. You’ve worked somewhere a step or two ahead of where we are, so you know what good looks like at our size.
- Owner’s mindset. You take work off the team’s plate and fix what you find.
- On call. Reliability and security response are shared across the team.
- In-person time. You’re open to team events a few times a year.
Full description
About us
is the platform for running reliable AI agents and workflows. Developers use it to build, deploy, and scale production systems with built-in tools for orchestration, scheduling, monitoring, and debugging.
Our Cloud product is a managed service where we deploy our users’ code and auto-scale from zero to millions of executions. Today, we serve thousands of teams building AI apps and agents, handling hundreds of millions of executions per month.
About the role
You’ll own security at Trigger.dev: our infrastructure, our app, the runtime that runs our users’ code, and the secrets they trust us with.
Some of our customers let their own users run code on Trigger.dev (think coding agents running whatever instructions they’re given). That code must never reach our systems or our customers’ systems. Keeping it contained is a feature we ship, so this is a product engineering role as much as a security one.
About half to three quarters of your time will be backend engineering. The rest is hunting for problems and fixing them. When you find something, you own the fix. You’ll set your own priorities and work with others when necessary.
We’re looking for an application security (AppSec) engineer who builds: a senior backend engineer who brings a security mindset to everything they ship.
What you’ll do
- Sandbox and runtime security. Design and harden the environments that isolate untrusted user code. This is the core of the role.
- Security features for customers. Build things like end-to-end encrypted secrets, log redaction, private networking, and runtime hardening.
- Automated offensive testing. Use AI tools to attack our own systems on a schedule, find weak spots, and fix them. Bring in outside pen testers when it’s worth it.
- Detection and response. Build monitoring and alerting for suspicious activity, improve our security observability, and lead the response when something needs a look.
- Vulnerability management. Run scanning and triage, own our vulnerability disclosure program, and handle incoming reports.
- Automated quality. Own our security PR reviews, automated scans, fixes, and triage.
- Write it down. Document how we do security so the rest of the team can answer customer questions with confidence.
- Security habits. Help the engineering team build secure habits with reviews, docs, and light guardrails.
Like everyone at Trigger.dev, you’ll also help in our Discord and GitHub community, write docs, and create content like blog posts, code examples, and videos.