Founding RASP Engineer – Node.js

This is a fully remote position, open to applicants in Poland.

📋 Description

• You will create an end-to-end runtime protection layer.

• The product involves a new product line that you will define — including what we intercept, what we exclude, and the customer-visible surface.

• The technical approach is flexible. You will determine the instrumentation strategy, deployment shape, and programming language while consulting with our architects.

• Implementation will be comprehensive. You will have access to the complete tooling stack we provide — including LLM subscriptions and modern development infrastructure. Utilize tools that enhance your efficiency.

• Methodology is up to you, as you decide how to build conviction in your detection logic.

• Cross-layer signal integration is key. Our existing stack generates threat intelligence at an unparalleled scale: monitoring tens of millions of sites, storing petabytes of malware samples, providing real-time domain and URL reputation, and offering IP-level attack feeds. You can leverage these resources as needed.

• The product is measured by four key metrics: runtime overhead, false positives, false negatives, and customer escalation volume. These metrics reflect the priorities of hosting providers and their clients. Achieving them effectively will ensure the product operates within a significant portion of the modern Node.js web.

⛳️ Requirements

• Familiarity with the Node.js runtime and the JavaScript ecosystem is essential.

• Strong fundamentals in web application security and up-to-date knowledge of practical exploitation techniques are required.

• A solid understanding of how detection rules perform at scale is necessary — knowing what captures attackers without flagging legitimate code is crucial.

• You should be capable of taking on roles as the PM, architect, lead engineer, and QA for this product. You are proactive in seeking resources or assistance when needed, rather than waiting for directions.

• Comfort in directing AI coding agents to produce high-quality results is important, as much of our engineering relies on this approach now.

• Previous experience with runtime protection products, application firewalls, or instrumentation tools is preferred.

• A background in malware analysis or incident response is valuable.

• Familiarity with managed hosting environments is beneficial.

• Contributions to public security research, vulnerability disclosures, or authored detection rulesets are a plus.

🏝️ Benefits

• Emphasis on professional development.

• Engaging and challenging projects.

• Fully remote work with flexible hours, allowing you to organize your day and work from anywhere globally.

• Paid vacation of 24 days per year, plus 10 national holidays, and unlimited sick leave.

• Compensation for private medical insurance.

• Reimbursement for co-working spaces and gym/sports activities.

• Budget allocated for education purposes.

• The chance to earn a reward for the most innovative idea that the company can patent.