Vulnerability Research Engineer
Socket · Engineering · Mid · 15d ago
$110k – $170k
per year
Anyone, anywhere in the world can apply.
Direct from the employer's own careers page
Who can apply
Read straight from the listing, so you know before you spend time on it.
Anyone, anywhere in the world can apply.
“Remote-first, with quarterly team off-sites”
- Async-first
- The listing doesn't promise async-first working.
- Contractor / B2B
- No mention of hiring international contractors or invoicing.
- Global stipend
- No home office or equipment budget mentioned.
- Annual retreat
- Quarterly team off-sites are offered.
Read from the listing automatically. Always confirm the details with the company before you accept an offer.
About the role
As a Vulnerability Research Engineer at Socket, you will build and scale patching infrastructure that delivers secure, vetted packages to developers worldwide. You will lead patching efforts for high-impact vulnerabilities across npm packages, design scalable patch delivery systems, automate workflows, and collaborate with security researchers to secure the broader software supply chain.
What you'll do
- Lead patching efforts for high-impact vulnerabilities across npm and other package ecosystems
- Scale patch production to dozens or hundreds of patches per week
- Build and improve automated patching infrastructure, tooling, and delivery systems
- Develop automated vulnerability detection, patch creation workflows, and quality assurance tooling
- Work with security researchers to understand and resolve critical vulnerabilities
- Build APIs and integrations to deliver certified and remediated packages
What you bring
- 3+ years of software engineering experience with production systems
- Strong proficiency in Node.js, JavaScript, and TypeScript
- Experience with package managers (npm, yarn, pnpm) and the JavaScript ecosystem
- Understanding of software security concepts and vulnerability management
- Experience building and scaling APIs and data processing pipelines
- Familiarity with automated testing, CI/CD, and deployment systems
About Socket
Socket helps developers and security teams protect the software supply chain by safely finding, auditing, and managing open-source dependencies. Founded by open-source maintainer Feross Aboukhadijeh, Socket has raised $125M and serves high-profile tech companies globally.
View Socket profile & open roles →