8 hours ago
Remote, United StatesMid Level
H1B sponsor
Base Salary
$110k - $170k/yr
Responsibilities
- Master Socket workflows, tools, and patching processes.
- Lead patching efforts for high-impact vulnerabilities across npm packages.
- Scale patch production to dozens or hundreds of patches per week.
- Select and prioritize high-value patches based on ecosystem and customer impact.
- Build and improve automated patching infrastructure and tooling.
- Design and implement scalable patch generation and delivery systems.
- Develop automated vulnerability detection and patch creation workflows.
- Build APIs and integrations to deliver certified packages.
- Create tooling for patch quality assurance and testing.
- Work with security researchers to understand and patch critical vulnerabilities.
- Help shape the technical roadmap for expansion and provide safe remediation options for developers.
Requirements
- 3+ years of software engineering experience with production systems.
- Strong proficiency in Node.js, JavaScript, and TypeScript.
- Experience with package managers including npm, yarn, and pnpm and with the JavaScript ecosystem.
- Understanding of software security concepts and vulnerability management.
- Experience building and scaling APIs and data processing pipelines.
- Familiarity with automated testing, CI/CD, and deployment systems.
- Preferred: experience with security tooling, vulnerability scanning, or patch management.
- Preferred: knowledge of software supply chain security challenges.
- Preferred: experience with Python, Go, Rust, or other package ecosystems.
- Preferred: open source contributions or package maintenance experience.
- Preferred: background in DevSecOps or security engineering.
- Preferred: experience with high-throughput data processing systems.
Benefits
- Market-competitive salary bands and a meaningful equity program.
- Comprehensive health benefits for employees and families with 99% coverage.
- Flexible time off, holidays, and a winter shutdown.
- Paid parental leave.
- Remote-first work arrangement with quarterly team off-sites.
Tech Stack
About Socket
Socket builds a cybersecurity platform that detects malware and supply chain risks in open-source dependencies for engineering and security teams. The privately held company, founded in 2020 and based in San Francisco, offers tools for safely finding, auditing, and managing third-party packages. Customers include Anthropic, xAI, Figma, and Vercel.