[Hiring] Security Engineer / Staff Engineer @Alex Staff Agency

Role Description

We are looking for an engineer-architect to build a new product from scratch. This is not a position within an existing team—you will single-handedly create a runtime protection layer for Node.js applications. Your mission is to make protection automatic, transparent to client code, and effective in real time.

This is a role with the highest level of ownership (Senior / Staff / Architect level), where you will make key architectural decisions and take full responsibility for the outcome.

Responsibilities

• Define the technical approach for building runtime protection inside the Node.js process.
• Design the detection logic to identify and block attacks during application execution.
• Build and launch the first version of the product in real production environments.
• Ensure the protection works without requiring changes to client code and without breaking legitimate applications.
• Continuously improve the product based on telemetry, production feedback, and real-world incidents.
• Achieve target values across four key metrics:
  • Runtime overhead
  • False positives
  • False negatives
  • Customer escalation volume

Qualifications

• Experience in Security Engineering or Security Research (deep understanding of attack vectors and defense methods).
• Have independently built and shipped a product/solution from scratch (end-to-end ownership: from idea to production).
• Ability to take an ambiguous problem, define a solution, and deliver a working result without constant supervision.
• Experience designing architecture and making key technical decisions (Staff/Architect level is a strong plus).
• English language: Intermediate or higher (written and spoken — all interviews are conducted in English).

Requirements

• Security experience specifically in the context of Node.js (vulnerability analysis, securing, researching Node.js applications).
• Experience with Linux in production and development environments.
• Knowledge of Runtime Protection, WAF, instrumentation, malware analysis, and Incident Response.
• Experience in managed hosting / VPS domains.
• Experience with AI coding agents (Copilot, Cursor, etc.).
• Important: If you are a Security Engineer / Researcher who doesn't code on a daily basis, you must be comfortable using AI-assisted development tools and be capable of building an MVP with their help.

Benefits

• Format: 100% remote work anywhere in the world.
• Legal setup: B2B only (contract with your sole proprietorship or company).
• Budget: Up to $12,000 gross/month (before taxes, under a B2B agreement).

Company Description

A stable, established international product company with 15+ years in the market.

Role: A key position in building a new product line from the ground up.