[All remote jobs](https://jobicy.com/jobs.md)[![Socket logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1314ce3c-221.png)](https://jobicy.com/company/socket.md)[Socket](https://jobicy.com/company/socket.md) # Vulnerability Research Software Engineer Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/socket.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md), [Canada](https://jobicy.com/job-region/canada.md)SalaryUSD 110k–170k / yrDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceOpen levelPublished27 Oct 2026Apply before26 Nov 2026Listing views56Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Socket is hiring a Vulnerability Research Software Engineer to build patching infrastructure that delivers vetted open-source packages to developers. The role centers on Rust, Unix/Linux, CLI tooling, package-manager integrations, APIs, automated patching, and quality assurance. The engineer will work with security researchers to remediate critical vulnerabilities and improve software supply-chain security across package ecosystems. This is a remote-first, full-time position available in Canada and the United States, with meaningful ownership in an early-stage team. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThe role requires strong production engineering across Rust, Unix tooling, package ecosystems, APIs, and security workflows. Rapid patch production and responsibility for edge cases in developer-facing remediation systems make the technical and operational bar high. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$140,000US market range (per year)$125k–$190k0$209.00k AI insightThe employer discloses a yearly base-compensation range of $110,000–$170,000 USD, with a midpoint of $140,000. Estimated US market pay for a mid-level software/security engineer specializing in supply-chain security is approximately $125,000–$190,000 USD per year. ## Core skills Skills and capabilities most closely associated with this opportunity. [Rust](https://jobicy.com/jobs?search_keywords=Rust.md)[Unix/Linux](https://jobicy.com/jobs?search_keywords=UnixLinux.md)[Node.js](https://jobicy.com/jobs?search_keywords=Node.js.md)[JavaScript](https://jobicy.com/jobs?search_keywords=JavaScript.md)[TypeScript](https://jobicy.com/jobs?search_keywords=TypeScript.md)[React](https://jobicy.com/jobs?search_keywords=React.md)[CLI development](https://jobicy.com/jobs?search_keywords=CLI%20development.md)[Package management](https://jobicy.com/jobs?search_keywords=Package%20management.md)[npm](https://jobicy.com/jobs?search_keywords=npm.md)[API development](https://jobicy.com/jobs?search_keywords=API%20development.md)[Software supply chain security](https://jobicy.com/jobs?search_keywords=Software%20supply%20chain%20security.md)[Vulnerability management](https://jobicy.com/jobs?search_keywords=Vulnerability%20management.md)[CI/CD](https://jobicy.com/jobs?search_keywords=CICD.md)[Automated testing](https://jobicy.com/jobs?search_keywords=Automated%20testing.md)[DevSecOps](https://jobicy.com/jobs?search_keywords=DevSecOps.md) Sample interview questionsHow would you design a safe automated patching workflow for a critical vulnerability in a widely used npm package?I would begin by reproducing and scoping the vulnerability, identifying supported versions and dependency constraints. I would create a minimal patch, validate it with unit, integration, and regression tests, and run compatibility checks against representative consumer environments. Finally, I would publish signed or traceable artifacts, document limitations, and monitor rollout results so the patch can be quickly revised if ecosystem-specific issues emerge. Describe an approach to building a resilient CLI used across varied Unix environments. I would define stable command contracts, clear exit codes, structured output options, and actionable error messages. The implementation should avoid environment assumptions, validate external tool availability, handle filesystem and permission differences, and provide deterministic configuration precedence. I would test across supported operating systems and shells, including failure paths such as interrupted execution and malformed lockfiles. What package-manager edge cases would you consider when implementing support for npm, Yarn, and pnpm? I would account for lockfile format and version differences, workspace layouts, peer dependencies, optional dependencies, overrides or resolutions, registries, caches, integrity hashes, and lifecycle scripts. I would also verify behavior with monorepos and private packages. The integration should preserve reproducibility while making any required dependency changes explicit to the developer. How would you collaborate with security researchers when turning vulnerability findings into production patches? I would establish a shared severity assessment, reproduction case, affected-version matrix, and remediation timeline. I would translate the research into engineering requirements while preserving confidential details until disclosure is appropriate. Throughout implementation, I would use clear review checkpoints so researchers can validate that the patch fully addresses the exploit path without creating regressions. How do you balance rapid vulnerability remediation with patch quality? I prioritize by exploitability, blast radius, and available mitigations, then use automation to shorten validation rather than skipping it. A focused test suite, reproducible builds, peer review, and staged rollout provide fast confidence for urgent fixes. For high-risk changes, I would ship a safe mitigation first where possible and follow with a fully validated long-term patch. Opportunity details ## About this role. About Us Socket helps devs and security teams ship faster by cutting out security busywork. Thousands of orgs use Socket to safely find, audit, and manage open source code. Our customers – from Anthropic to xAI, and Figma to Vercel – love Socket (just [check out their tweets](https://socket.dev/love) to see for yourself!) Founded by [Feross Aboukhadijeh](https://www.linkedin.com/in/feross/), a long-time open source maintainer with software downloaded over a billion times a month, Socket has raised [$](https://socket.dev/blog/series-b)[125M in funding](https://socket.dev/blog/series-c) from top angels, operators, and security leaders. About the Role Join Socket to build and scale our patching infrastructure that delivers secure, vetted packages to developers worldwide. You’ll be at the forefront of supply chain security, creating patches for critical vulnerabilities and building the systems that help the entire open source ecosystem stay secure. This role emphasizes deep software engineering expertise, especially in Rust and Unix environments. You’ll tackle challenging CLI work—scoping, troubleshooting, and addressing edge cases across multiple package managers. This role combines engineering work with meaningful community impact that benefits the entire ecosystem. As an early member of the Socket team, you’ll help shape how we scale this technology. What You’ll Do * Master Socket workflows, tools, and patching processes * Build and maintain CLI tooling used in customer environments. * Implement package-manager integrations and handle ecosystem-specific edge cases. * Translate dependency and vulnerability workflows into reliable developer-facing interfaces. * Debug implementation issues across Unix-based environments. * Work closely with the patch team to scope work, troubleshoot problems, and ship practical improvements. * Contribute to frontend experiences using JavaScript, React, and TypeScript. * Scale patch production to dozens or hundreds of patches per week * Build and improve automated patching infrastructure and tooling * Build APIs and integrations to deliver certified packages * Create tooling for patch quality assurance and testing * Work with security researchers to understand and patch critical vulnerabilities * Give developers quick, safe remediation options for widely-used packages * Help secure the software supply chain for millions of developers What You’ll Bring Required: * 3+ years of software engineering experience with production systems * Strong proficiency in Rust and Unix/Linux environments * Proficiency in Node.js, JavaScript, and TypeScript * Experience with package managers (npm, yarn, pnpm) and the JavaScript ecosystem * Understanding of software security concepts and vulnerability management * Experience building and scaling APIs and data processing pipelines * Familiarity with automated testing, CI/CD, and deployment systems Preferred: * Experience with security tooling, vulnerability scanning, or patch management * Knowledge of software supply chain security challenges * Experience with other package ecosystems (Python, Go, etc.) * Open source contributions or package maintenance experience * Background in DevSecOps or security engineering * Experience with high-throughput data processing systems Our Interview Process * Informational with a member from our Talent Team * Hiring Manager Interview * Peer Interview * Take-home problem Internal review of take-home * Live review of take-home * Debrief * Final Interview with our founder * References * Decision/Offer Hiring is a big decision on both sides. Read more about our [Hiring Philosophy](https://socket.dev/hiring-philosophy)and how we approach the process at Socket. Benefits: Our benefits are crafted to support you and your family, so you can take care of what matters most and thrive in and outside of work. We offer: * Market competitive salary bands * Meaningful equity program * Comprehensive health benefits for you and your family (99% coverage) * Flexible time-off, holidays, and winter shutdown to rest & recharge * Paid parental leave * Remote-first, with quarterly team off-sites At Socket, we * Pursue Excellence: We set ourselves apart by consistently delivering work of exceptional quality and distinction. * Move with urgency and focus: We prioritize swift, decisive action. * Think rigorously: We care about being right and it often takes reasoning from first principles to get there. We value alternative perspectives and have constructive discussions. * Trust and amplify: We overtrust, always assume good intent, and give specific feedback to help each other improve. * Feel a strong sense of ownership: We wear many hats and feel a strong sense of overall ownership of the company and we’re non-territorial regarding our nominal domains. * Are customer obsessed: We relentlessly prioritize the needs of our customers, striving to exceed their expectations and delight them at every interaction. Show more [Apply now >](https://jobicy.com/jobs/157395-vulnerability-research-software-engineer.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Software Engineer, Firefox Security](https://jobicy.com/jobs/157410-senior-software-engineer-firefox-security.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Security GRC Engineer](https://jobicy.com/jobs/157406-senior-security-grc-engineer.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Mozilla logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/mozilla.jpg) Mozilla Oct 27 New ### [Senior Security Engineer – SecOps](https://jobicy.com/jobs/157401-senior-security-engineer-secops.md) Why Mozilla? Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. We make pioneering brands like Firefox, the privacy-minded… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 27 New ### [Senior Phishing Tradecraft Researcher](https://jobicy.com/jobs/157339-senior-phishing-tradecraft-researcher.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 27 New ### [Senior Manager, Detection Engineering & Threat Hunting](https://jobicy.com/jobs/157334-senior-manager-detection-engineering-threat-hunting.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 27 New ### [Principal Product Security Researcher](https://jobicy.com/jobs/157330-principal-product-security-researcher-2.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 27 New ### [Principal Product Security Engineer](https://jobicy.com/jobs/157328-principal-product-security-engineer.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Airtm logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/1994f28e-221.png) Airtm Oct 27 New ### [Head of security](https://jobicy.com/jobs/157316-head-of-security-2.md) About us: Airtm is a financial-infrastructure company building the future of the online-work economy. We are on a mission to empower the world’s growing number of Digital Entrepreneurs in the… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 27 New ### [Security Engineer, Agent Security](https://jobicy.com/jobs/151775-security-engineer-agent-security.md) About the TeamThe team’s mission is to accelerate the secure evolution of agentic AI systems at OpenAI. To achieve this, the team designs, implements, and continuously refines security policies, frameworks,… * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Oct 27 New ### [Technical Threat Investigator, Threat Intel Engineering](https://jobicy.com/jobs/151752-technical-threat-investigator-threat-intel-engineering.md) About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Threat Intelligence team protects OpenAI’s technology, people, research,… [Browse all jobs](https://jobicy.com/jobs.md)