{"schemaVersion":"jobsearcher.job.v1","id":"18d603c5e80b707bedd78323","url":"https://jobsearcher.com/jobs/18d603c5e80b707bedd78323","canonicalUrl":"https://jobsearcher.com/jobs/18d603c5e80b707bedd78323","title":"Full-Stack Engineer (Security)","description":"About UsRelay is a cross-chain payments protocol that provides instant, low-cost cross-chain bridging, swaps, and transactions. We're the fastest and cheapest way to bridge and transact across chains, serving over 5 million users who have completed 59+ million transactions with $6+ billion in volume across 85+ chains.Our mission is to make transacting across chains as fast, cheap, and reliable as online payments. We are building the core infrastructure to abstract chains from end user payments, enabling the next billion users to experience the benefits of blockchain without the UX burdens.About The RoleWe're hiring a full-stack engineer who cares deeply about security to work side by side with our Head of Security, who leads security at Relay. Money moves through our systems 24/7, and attackers, from address poisoners to MEV searchers, are watching the same flows we are. Your job is to make Relay a hard target and to make security something product teams can build in, not bolt on.Development runs in containers. Production access is read-only by default, with a written path for state-changing actions. Decisions are recorded with their evidence and reviewed later. We lean on AI-assisted tooling, including our own audit agents, and expect you to extend it rather than start over.In this role, you'll own several production security systems end to end, each of which is a detection or denial control, and you'll partner with product engineers to ship security features that users and integrators can see and trust. This is an individual contributor, hands-on full-stack engineering role. You'll write code every day, deploy it, and run it in production: building services and the tools and interfaces around them, instrumenting them, setting up monitoring and alerts, and being on call for what you ship.What you'll doOwn our wallet screening microserviceOwn the service that screens wallet addresses before and during transactions: verdict quality, caching and rescreening behavior, latency, and uptimeRecommend and integrate risk vendors and data sources, and decide at which stage of a transaction (quote, deposit, fill, refund) and on which chains and address roles (sender, recipient, intermediary) each one appliesMake blocking decisions explainable: clear error codes and messages for integrators, and auditable reports of what was blocked and whyBuild the override and watchlist tooling around the service with caller authorization, confirmation steps, and an audit trailHandle partner and compliance requests about screening coverage, including blocked-address reportingKeep the fail-closed guarantees honest across every flow that moves funds, including refunds, and prove it with testsOwn our sandwich-attack trackerTurn the tracker into a production system that detects sandwich attacks and other MEV extraction against our users' transactions, in near real timeMeasure it: precision and recall against labelled cases, per chain, with the back-test suite in CIQuantify impact by chain, route, and integrator, and trace attacks back to where a transaction became visibleWork with Solving, Infrastructure and Protocol engineers to design mitigations, such as private submission, routing changes, and slippage guidance, and measure whether they workRun investigations with our Head of Security when an incident is live and write up what happened and what changedMaintain Vigil, our internal auditing toolOwn Vigil as a product for our engineers: keep it reliable, keep its checks current, and decide what it audits nextTreat it as what it is, an LLM-driven audit harness: prompt and rule changes are production changes, every false-positive rule carries evidence, and a regression set keeps it honestKeep findings triage accurate and actionable, with clear severity, ownership, and a path from finding to fix (including delegation to our internal AI agent and Linear tickets)Cut noise and false positives so teams trust Vigil's findings and act on themExtend Vigil as our systems and threats change, feed incidents back into it, and make sure its findings feed the screening service, the sandwich tracker, and product security workBuild the detection and response loopRun the daily loss review as an automated job with alerting, and own the monitors that catch mispricing, unexpected refunds, and fills that deviate from their quotesBuild the watchlist and early-warning pipeline that denies exit rails to the proceeds of third-party hacks within the hourWrite the postmortem, that pertain to your domain, and turn its lessons into a check, a monitor, or a ruleBuild security features with product teamsSit with product teams at design time to threat-model new features, especially anything that moves, holds, or refunds fundsBuild shared security building blocks (permissions, caller-scoped reads with field allowlists, audit trails, secrets handling, rate and abuse controls) so teams reuse them instead of reinventing themReview changes for security risk and help teams adopt secure-by-default patternsUse AI-assisted tooling to review code, enumerate attack paths, and triage findings fasterAbout YouYou build the feedback loop for your own judgement: back-tests, regression sets and post-incident checks, because the misses that cost the most looked harmless at firstYou've run security-sensitive systems in productionYou enjoy working with product engineers and can turn a threat model into a change they're glad to makeYou're curious about crypto's adversarial conditions: MEV, mempools, address poisoning, sanctioned and illicit flowsYou're comfortable being on call for 24/7 financial infrastructure and calm during live incidentsYou write things down: a decision with its evidence, an incident with its timeline, a finding with its severity and ownerSkills And AbilitiesMust-haveHands-on full-stack engineering experience: you build, deploy, and maintain production services yourself, including instrumentation, logging, monitoring, and alerting4+ years as a software engineer building and running production systems, with a real interest in security (you don't need a security title)Strong TypeScript, and comfort across the stack: backend services, databases, and small internal UIs; you can also review other people's code for security flawsDistributed-systems correctness: queues, retries, idempotency, race conditions, and unit or decimal boundaries, and the habit of asking what happens when a response is lost or a job runs twiceExperience building or operating detection, screening, fraud, or abuse-prevention systems, and measuring them against ground truth: precision, recall, and the cost of each kind of errorOn-chain transaction analysis on EVM chains: receipts, logs, block ordering, pool mechanics, and the tooling to trace funds and cluster walletsExperience operating LLM-based automation in production: evals, regression sets, and prompt or rule changes treated with the same discipline as codeContainers and cluster deployment: you can land a service in a Kubernetes cluster with its secrets in the secret store, not on a personal accountYou can read Solidity well enough to judge whether an automated finding against a contract is realExperience threat modeling and running security reviews of new features with product teamsFamiliarity with secrets management, identity and access, auditability, and safe handling of side effectsStrong written communication for incident write-ups and partner or compliance questions; you've written a postmortem that changed a systemNice to haveExperience with Rust (we use a little of it, and you'll read more than you write)Smart contract auditing, wallet security, or deeper MEV and mempool experienceExperience with AML, sanctions, or wallet-risk vendors and the integrations around themExperience building indexers or block-level toolingExperience in payments, exchanges, or another high-stakes domainApplied offensive mindset: you've reproduced an exploit against your own systems, written a proof of concept from a vague report, or run purple-team exercises, and you can walk a finding from the data it exposes to what an attacker would actually do with itAwareness of security trends and industry-specific threatsWhat we offerCompetitive base salaryEquity packageComprehensive health benefitsUnlimited PTO policy with encouraged minimumRemote-first culture with emphasis on collaboration, communication, and flexibility","company":"Relay","rawCompany":"relay","city":"Denver","state":"CO","isRemote":false,"isActive":false,"createdAt":"2026-11-01T07:10:07.335Z","occupations":[{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"},{"code":"15-1299.07","title":"Blockchain Engineers","slug":"blockchain-engineers"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Full-Stack Engineer (Security)","description":"About UsRelay is a cross-chain payments protocol that provides instant, low-cost cross-chain bridging, swaps, and transactions. We're the fastest and cheapest way to bridge and transact across chains, serving over 5 million users who have completed 59+ million transactions with $6+ billion in volume across 85+ chains.Our mission is to make transacting across chains as fast, cheap, and reliable as online payments. We are building the core infrastructure to abstract chains from end user payments, enabling the next billion users to experience the benefits of blockchain without the UX burdens.About The RoleWe're hiring a full-stack engineer who cares deeply about security to work side by side with our Head of Security, who leads security at Relay. Money moves through our systems 24/7, and attackers, from address poisoners to MEV searchers, are watching the same flows we are. Your job is to make Relay a hard target and to make security something product teams can build in, not bolt on.Development runs in containers. Production access is read-only by default, with a written path for state-changing actions. Decisions are recorded with their evidence and reviewed later. We lean on AI-assisted tooling, including our own audit agents, and expect you to extend it rather than start over.In this role, you'll own several production security systems end to end, each of which is a detection or denial control, and you'll partner with product engineers to ship security features that users and integrators can see and trust. This is an individual contributor, hands-on full-stack engineering role. You'll write code every day, deploy it, and run it in production: building services and the tools and interfaces around them, instrumenting them, setting up monitoring and alerts, and being on call for what you ship.What you'll doOwn our wallet screening microserviceOwn the service that screens wallet addresses before and during transactions: verdict quality, caching and rescreening behavior, latency, and uptimeRecommend and integrate risk vendors and data sources, and decide at which stage of a transaction (quote, deposit, fill, refund) and on which chains and address roles (sender, recipient, intermediary) each one appliesMake blocking decisions explainable: clear error codes and messages for integrators, and auditable reports of what was blocked and whyBuild the override and watchlist tooling around the service with caller authorization, confirmation steps, and an audit trailHandle partner and compliance requests about screening coverage, including blocked-address reportingKeep the fail-closed guarantees honest across every flow that moves funds, including refunds, and prove it with testsOwn our sandwich-attack trackerTurn the tracker into a production system that detects sandwich attacks and other MEV extraction against our users' transactions, in near real timeMeasure it: precision and recall against labelled cases, per chain, with the back-test suite in CIQuantify impact by chain, route, and integrator, and trace attacks back to where a transaction became visibleWork with Solving, Infrastructure and Protocol engineers to design mitigations, such as private submission, routing changes, and slippage guidance, and measure whether they workRun investigations with our Head of Security when an incident is live and write up what happened and what changedMaintain Vigil, our internal auditing toolOwn Vigil as a product for our engineers: keep it reliable, keep its checks current, and decide what it audits nextTreat it as what it is, an LLM-driven audit harness: prompt and rule changes are production changes, every false-positive rule carries evidence, and a regression set keeps it honestKeep findings triage accurate and actionable, with clear severity, ownership, and a path from finding to fix (including delegation to our internal AI agent and Linear tickets)Cut noise and false positives so teams trust Vigil's findings and act on themExtend Vigil as our systems and threats change, feed incidents back into it, and make sure its findings feed the screening service, the sandwich tracker, and product security workBuild the detection and response loopRun the daily loss review as an automated job with alerting, and own the monitors that catch mispricing, unexpected refunds, and fills that deviate from their quotesBuild the watchlist and early-warning pipeline that denies exit rails to the proceeds of third-party hacks within the hourWrite the postmortem, that pertain to your domain, and turn its lessons into a check, a monitor, or a ruleBuild security features with product teamsSit with product teams at design time to threat-model new features, especially anything that moves, holds, or refunds fundsBuild shared security building blocks (permissions, caller-scoped reads with field allowlists, audit trails, secrets handling, rate and abuse controls) so teams reuse them instead of reinventing themReview changes for security risk and help teams adopt secure-by-default patternsUse AI-assisted tooling to review code, enumerate attack paths, and triage findings fasterAbout YouYou build the feedback loop for your own judgement: back-tests, regression sets and post-incident checks, because the misses that cost the most looked harmless at firstYou've run security-sensitive systems in productionYou enjoy working with product engineers and can turn a threat model into a change they're glad to makeYou're curious about crypto's adversarial conditions: MEV, mempools, address poisoning, sanctioned and illicit flowsYou're comfortable being on call for 24/7 financial infrastructure and calm during live incidentsYou write things down: a decision with its evidence, an incident with its timeline, a finding with its severity and ownerSkills And AbilitiesMust-haveHands-on full-stack engineering experience: you build, deploy, and maintain production services yourself, including instrumentation, logging, monitoring, and alerting4+ years as a software engineer building and running production systems, with a real interest in security (you don't need a security title)Strong TypeScript, and comfort across the stack: backend services, databases, and small internal UIs; you can also review other people's code for security flawsDistributed-systems correctness: queues, retries, idempotency, race conditions, and unit or decimal boundaries, and the habit of asking what happens when a response is lost or a job runs twiceExperience building or operating detection, screening, fraud, or abuse-prevention systems, and measuring them against ground truth: precision, recall, and the cost of each kind of errorOn-chain transaction analysis on EVM chains: receipts, logs, block ordering, pool mechanics, and the tooling to trace funds and cluster walletsExperience operating LLM-based automation in production: evals, regression sets, and prompt or rule changes treated with the same discipline as codeContainers and cluster deployment: you can land a service in a Kubernetes cluster with its secrets in the secret store, not on a personal accountYou can read Solidity well enough to judge whether an automated finding against a contract is realExperience threat modeling and running security reviews of new features with product teamsFamiliarity with secrets management, identity and access, auditability, and safe handling of side effectsStrong written communication for incident write-ups and partner or compliance questions; you've written a postmortem that changed a systemNice to haveExperience with Rust (we use a little of it, and you'll read more than you write)Smart contract auditing, wallet security, or deeper MEV and mempool experienceExperience with AML, sanctions, or wallet-risk vendors and the integrations around themExperience building indexers or block-level toolingExperience in payments, exchanges, or another high-stakes domainApplied offensive mindset: you've reproduced an exploit against your own systems, written a proof of concept from a vague report, or run purple-team exercises, and you can walk a finding from the data it exposes to what an attacker would actually do with itAwareness of security trends and industry-specific threatsWhat we offerCompetitive base salaryEquity packageComprehensive health benefitsUnlimited PTO policy with encouraged minimumRemote-first culture with emphasis on collaboration, communication, and flexibility","datePosted":"2026-11-01T07:10:07.335Z","dateModified":"2026-11-01T07:10:07.335Z","hiringOrganization":{"@type":"Organization","name":"Relay","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Denver","addressRegion":"CO","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"18d603c5e80b707bedd78323"},"url":"https://jobsearcher.com/jobs/18d603c5e80b707bedd78323"}}