About the role
You'll build and ship the product: the web app, the APIs behind it, and the plumbing that connects them. This is primarily a full stack engineering role. The twist: the product is a security platform, so you'll be expected to write code that doesn't create the very problems we're built to find. You don't need to be a security expert on day one, but you do need to care.
What you'll do
- Build features end to end: UI, API endpoints, database, and the background jobs in between
- Write backend services in Python (FastAPI) and frontend in HTML/CSS/JavaScript
- Design and query relational data (PostgreSQL): schemas, migrations, sensible indexes
- Work with background workers and queues so long-running jobs don't block the app
- Debug across the whole stack: browser network tab, API, worker, database
- Write code that holds up: input validation, proper auth checks, no secrets in the repo
- Package and run things in Docker; understand how your code reaches production
What we're looking for
- Python: solid; you can build a working API, not just scripts. FastAPI experience is a strong advantage
- JavaScript and TypeScript: comfortable with the DOM, fetch, async/await, and building maintainable frontend code
- Next.js: basic familiarity with pages or app routing, server/client components, and integrating APIs is helpful
- HTML/CSS: can build a clean, responsive page without a component library holding your hand
- SQL: joins, indexes, and why a query is slow
- Git: branches, sensible commits, reading a diff
- Familiarity with the OWASP Top 10. Enough to avoid writing those bugs yourself: SQL injection, XSS, broken auth, IDOR, CSRF
- Treats user input as untrusted by default, and checks authorization server-side every time
- Open to having your code reviewed for security, and to reviewing someone else's the same way
- You've built and shipped something real: a personal project, a hackathon build, or an internship project. It doesn't have to be big; it has to work.
- AI tools are welcome, but you must learn, explain, test, and take responsibility for any code you submit. Do not use generated code you do not understand
Nice to have
- Go: parts of our tooling ecosystem live there
- Docker Compose, CI/CD, or any cloud (GCP/AWS/DigitalOcean)
- Experience with an auth provider (Supabase, Auth0, Firebase) or rolling sessions/JWTs yourself
- Any security research, vulnerability disclosure, or bug bounty exposure. A real plus, not a requirement
What you'll get
- Ownership of real features that users touch, not a sandboxed side project
- Mentorship on both product engineering and secure coding