[![Image]() Meet Jobicy Copilot — free AI autofill for job applications + remote job alerts ›](#)   [All remote jobs](https://jobicy.com/jobs.md)Open role[![Socket logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1314ce3c-221.png)](https://jobicy.com/company/socket.md)Remote opportunity at[Socket](https://jobicy.com/company/socket.md)

# Vulnerability Research Engineer

Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move.

[Apply for this job](#job-application)[View company](https://jobicy.com/company/socket.md)Share15 Sep 2026Published20Listing views0Application actions15 Oct 2026Apply before  Opportunity details

## About this role.

AI SummarySocket is seeking a Vulnerability Research Engineer to lead remediation of high-impact vulnerabilities in npm packages and strengthen software supply-chain security. The role combines hands-on JavaScript and TypeScript engineering with vulnerability research, patch development, automated testing, and package-delivery infrastructure. The engineer will build scalable systems for vulnerability detection, patch generation, quality assurance, APIs, and integrations. Success requires strong ownership, rapid but rigorous technical judgment, and close collaboration with security researchers to deliver safe remediation options at ecosystem scale.

## Role DNA

A quick view of the complexity, pace, ownership and collaboration implied by the job description.

### Job Complexity

5/5EasyHard

### Pace & Pressure

5/5RelaxedFast-paced

### Autonomy Level

5/5GuidedFull ownership

### Communication Load

4/5IndependentCollaborative

AI insightThis is a technically demanding security-engineering role involving production patching for critical vulnerabilities, high-throughput automation, and correctness-sensitive supply-chain systems. The engineer must make sound independent decisions while balancing urgency, package compatibility, security impact, and developer usability.

## Salary analysis

Estimated compensation compared with the broader US market for similar roles.

Estimated job medianMarket rate$140,000US market range$120k–$185k0$204k

AI insightThe disclosed yearly salary range is USD 110,000–170,000, with a midpoint of USD 140,000. For a US-based vulnerability or software supply-chain security engineer with 3+ years of experience, an estimated market range is USD 120,000–185,000 annually; compensation may vary with location, depth of security research expertise, and equity.

## Core skills

Skills and capabilities most closely associated with this opportunity.

[Vulnerability management](https://jobicy.com/jobs?search_keywords=Vulnerability%20management.md)[Software supply chain security](https://jobicy.com/jobs?search_keywords=Software%20supply%20chain%20security.md)[Node.js](https://jobicy.com/jobs?search_keywords=Node.js.md)[JavaScript](https://jobicy.com/jobs?search_keywords=JavaScript.md)[TypeScript](https://jobicy.com/jobs?search_keywords=TypeScript.md)[npm](https://jobicy.com/jobs?search_keywords=npm.md)[API development](https://jobicy.com/jobs?search_keywords=API%20development.md)[CI/CD](https://jobicy.com/jobs?search_keywords=CICD.md)[Automated testing](https://jobicy.com/jobs?search_keywords=Automated%20testing.md)[DevSecOps](https://jobicy.com/jobs?search_keywords=DevSecOps.md)

Sample interview questionsHow would you evaluate and prioritize a newly disclosed vulnerability in a widely used npm package?I would validate the advisory and affected versions, assess exploitability and likely impact, map transitive dependency exposure, and evaluate package reach among customers and the broader ecosystem. I would then prioritize based on severity, active exploitation signals, availability of upstream fixes, and the feasibility of producing a safe compatible patch.

Describe your process for creating a secure patch when an upstream fix is unavailable or cannot be adopted quickly.

I would first reproduce the issue with a minimal test case and identify the vulnerable execution path. I would implement the smallest defensible change, add regression and compatibility tests, review dependency and API implications, and validate the patch across relevant Node.js and package-manager environments before publication.

How would you design an automated pipeline for generating and validating package patches at high volume?

I would use a workflow that ingests trusted vulnerability data, resolves affected dependency graphs, creates isolated reproducible builds, applies controlled patch templates or changes, and runs layered security and functional tests. The pipeline should include provenance records, policy gates, rollback capability, observability, and human review for ambiguous or high-risk changes.

What risks are unique to software supply-chain patching, and how would you mitigate them?

Key risks include introducing malicious or incompatible changes, incomplete dependency coverage, compromised build inputs, and loss of package provenance. I would mitigate them with isolated builds, pinned and verified dependencies, signed artifacts, SBOMs, reproducible build practices, comprehensive regression testing, and auditable approval workflows.

How do you balance urgency with quality when remediating a critical vulnerability?

I use risk-based triage: immediately contain exposure where possible, establish a minimal verified remediation path, and communicate clear status and limitations. I prioritize automated regression coverage and peer review for critical changes, then follow with broader compatibility validation and post-release monitoring rather than sacrificing essential safety controls.

About Us

Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers – from Anthropic to xAI, and Figma to Vercel – love Socket (just [check out their tweets](https://socket.dev/love) to see for yourself!)

Founded by [Feross Aboukhadijeh](https://www.linkedin.com/in/feross/), a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised [$](https://socket.dev/blog/series-b)[125M in funding](https://socket.dev/blog/series-c) from top angels, operators, and security leaders.

About the Role

Join Socket to build and scale our patching infrastructure that delivers secure, vetted packages to developers worldwide. You’ll be at the forefront of supply chain security, creating patches for critical vulnerabilities and building the systems that help the entire open source ecosystem stay secure.

This role combines deep technical work with meaningful community impact that benefits the entire ecosystem. As an early member of the Socket team, you’ll help shape how we scale this technology across the JavaScript ecosystem and beyond.

What You’ll Do

*

Master Socket workflows, tools, and patching processes

*

Lead patching efforts for high-impact vulnerabilities across npm packages

*

Scale patch production to dozens or hundreds of patches per week

*

Help select and prioritize high-value patches

*

Provide technical input on patch prioritization based on ecosystem and customer impact

*

Build and improve automated patching infrastructure and tooling

*

Design and implement scalable patch generation and delivery systems

*

Develop automated vulnerability detection and patch creation workflows

*

Build APIs and integrations to deliver certified packages

*

Create tooling for patch quality assurance and testing

*

Work with security researchers to understand and patch critical vulnerabilities

*

Help shape the technical roadmap for expansion

*

Give developers quick, safe remediation options for widely-used packages

*

Help secure the software supply chain for millions of developers

What You’ll Bring

Required:

*

3+ years of software engineering experience with production systems

*

Strong proficiency in Node.js, JavaScript, and TypeScript

*

Experience with package managers (npm, yarn, pnpm) and the JavaScript ecosystem

*

Understanding of software security concepts and vulnerability management

*

Experience building and scaling APIs and data processing pipelines

*

Familiarity with automated testing, CI/CD, and deployment systems

Preferred:

*

Experience with security tooling, vulnerability scanning, or patch management

*

Knowledge of software supply chain security challenges

*

Experience with other package ecosystems (Python, Go, Rust, etc.)

*

Open source contributions or package maintenance experience

*

Background in DevSecOps or security engineering

*

Experience with high-throughput data processing systems

Our Interview Process

*

Informational with a member from our Talent Team

*

Hiring Manager Interview

*

Take-home problem

Internal review of take-home

*

Live review of take-home

*

Debrief

*

Final Interview with Feross

*

References

*

Decision/Offer

Hiring is a big decision on both sides. Read more about our [Hiring Philosophy](https://socket.dev/hiring-philosophy)and how we approach the process at Socket.

Benefits: Our benefits are crafted to support you and your family, so you can take care of what matters most and thrive in and outside of work. We offer:

*

Market competitive salary bands

*

Meaningful equity program

*

Comprehensive health benefits for you and your family (99% coverage)

*

Flexible time-off, holidays, and winter shutdown to rest & recharge

*

Paid parental leave

*

Remote-first, with quarterly team off-sites

At Socket, we

*

Pursue Excellence: We set ourselves apart by consistently delivering work of exceptional quality and distinction.

*

Move with urgency and focus: We prioritize swift, decisive action.

*

Think rigorously: We care about being right and it often takes reasoning from first principles to get there. We value alternative perspectives and have constructive discussions.

*

Trust and amplify: We overtrust, always assume good intent, and give specific feedback to help each other improve.

*

Feel a strong sense of ownership: We wear many hats and feel a strong sense of overall ownership of the company and we’re non-territorial regarding our nominal domains.

*

Are customer obsessed: We relentlessly prioritize the needs of our customers, striving to exceed their expectations and delight them at every interaction.

Show more

[Apply now >](https://jobicy.com/jobs/153339-vulnerability-research-engineer.md)

*

![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+)

### Upload your resume now

To unlock remote work opportunities and be discovered by global employers.

This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content.

Next step

## Apply now.

Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information.

Keep exploring

## Related remote jobs.

Matched by job category10 related opportunities[Cybersecurity](https://jobicy.com/categories/cybersecurity.md) [Browse all jobs](https://jobicy.com/jobs.md)
*
![Socket logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1314ce3c-221.png)
Socket  Sep 15

### [Forward Deployed Engineer, Python](https://jobicy.com/jobs/153341-forward-deployed-engineer-python.md)

About Us Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our…

*
![LivePerson logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/49f9583c-221.jpeg)
LivePerson  Sep 15

### [SecOps Engineer I](https://jobicy.com/jobs/153310-secops-engineer-i.md)

LivePerson (NASDAQ:LPSN) is a Conversational AI company creating digital experiences that are Curiously Human. Everyperson is unique, and our technology makes it possible for companies, including leading brands like HSBC,…

*
![UpGuard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/474a12c7-221.png)
UpGuard  Sep 14

### [Chief Information Security Officer](https://jobicy.com/jobs/153270-chief-information-security-officer-2.md)

Who are we? At UpGuard, we are replacing manual security bottlenecks with AI-driven precision. Fresh off a US$75M Series C, we are scaling our infrastructure to process 100 billion risk…

*
![BetterHelp logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/0b48fde8-221.jpeg)
BetterHelp  Sep 13

### [Head of Security Engineering](https://jobicy.com/jobs/153174-head-of-security-engineering.md)

Who are we and why should you join us? BetterHelp is on a mission to remove the traditional barriers to therapy and make mental health care more accessible to everyone….

*
![Deloitte logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/370c2482dacb3fffbd4043cfca5674fe.png)
Deloitte  Sep 13

### [Manager, Cyber Compliance, Deloitte Global Technology](https://jobicy.com/jobs/150563-manager-cyber-compliance-deloitte-global-technology.md)

Job Type: Permanent Work Model: Remote Reference code: 134501 Primary Location: Toronto, ON All Available Locations: Toronto, ON   Our Purpose   At Deloitte, our Purpose is to make an impact that matters. We exist to inspire…

*
![1Password logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/09/WRILS-200909195848-296323.png)
1Password  Sep 12

### [Manager, Security Incident Response](https://jobicy.com/jobs/153123-manager-security-incident-response.md)

1Password is growing. We’ve surpassed $400M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up…

*
![Sporty Group logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/8e6c246a-221.png)
Sporty Group  Sep 12

### [Offensive Security Engineer](https://jobicy.com/jobs/149060-offensive-security-engineer.md)

About the roleMission Strengthen Sporty’s offensive security posture by proactively testing and identifying vulnerabilities across our external perimeter, standalone virtual private servers (VPS), physical office infrastructure, and endpoint defenses. The…

*
![Rithum logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/fe3986d8-221-1.jpeg)
Rithum  Sep 12

### [Staff Information Security Engineer – AI First](https://jobicy.com/jobs/153112-staff-information-security-engineer-ai-first.md)

Rithum™ is the world’s most trusted commerce network, accelerating how brands, suppliers, and retailers work together to deliver seamless e-commerce experiences. We provide an unmatched platform for brands and retailers,…

*
![Liftoff logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/c47aea9f-221.png)
Liftoff  Sep 12

### [Security Engineer, Detection & Response](https://jobicy.com/jobs/153102-security-engineer-detection-response.md)

Liftoff is a leading AI-powered performance marketing platform for the mobile app economy. Our end-to-end technology stack helps app marketers acquire and retain high-value users, while enabling publishers to maximize…

*
![Stripe logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201011073943-272457.png)
Stripe  Sep 11

### [Abuse Research Engineer](https://jobicy.com/jobs/153053-abuse-research-engineer.md)

Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies—from the world’s largest enterprises to the most ambitious startups—use Stripe to accept payments, grow…