Full-Stack Engineer (Security)

Relay is a cross-chain payments protocol. The Full-Stack Engineer (Security) will build and operate production security systems, including wallet screening, MEV detection, and internal auditing tools, while partnering with product teams to deliver security features and improve detection and response.

Responsibilities:

• Own the service that screens wallet addresses before and during transactions: verdict quality, caching and rescreening behavior, latency, and uptime
• Recommend and integrate risk vendors and data sources, and decide at which stage of a transaction (quote, deposit, fill, refund) and on which chains and address roles (sender, recipient, intermediary) each one applies
• Make blocking decisions explainable: clear error codes and messages for integrators, and auditable reports of what was blocked and why
• Build the override and watchlist tooling around the service with caller authorization, confirmation steps, and an audit trail
• Handle partner and compliance requests about screening coverage, including blocked-address reporting
• Keep the fail-closed guarantees honest across every flow that moves funds, including refunds, and prove it with tests
• Turn the tracker into a production system that detects sandwich attacks and other MEV extraction against our users' transactions, in near real time
• Measure it: precision and recall against labelled cases, per chain, with the back-test suite in CI
• Quantify impact by chain, route, and integrator, and trace attacks back to where a transaction became visible
• Work with Solving, Infrastructure and Protocol engineers to design mitigations, such as private submission, routing changes, and slippage guidance, and measure whether they work
• Run investigations with our Head of Security when an incident is live and write up what happened and what changed
• Own Vigil as a product for our engineers: keep it reliable, keep its checks current, and decide what it audits next
• Treat it as what it is, an LLM-driven audit harness: prompt and rule changes are production changes, every false-positive rule carries evidence, and a regression set keeps it honest
• Keep findings triage accurate and actionable, with clear severity, ownership, and a path from finding to fix (including delegation to our internal AI agent and Linear tickets)
• Cut noise and false positives so teams trust Vigil's findings and act on them
• Extend Vigil as our systems and threats change, feed incidents back into it, and make sure its findings feed the screening service, the sandwich tracker, and product security work
• Run the daily loss review as an automated job with alerting, and own the monitors that catch mispricing, unexpected refunds, and fills that deviate from their quotes
• Build the watchlist and early-warning pipeline that denies exit rails to the proceeds of third-party hacks within the hour
• Write the postmortem, that pertain to your domain, and turn its lessons into a check, a monitor, or a rule
• Sit with product teams at design time to threat-model new features, especially anything that moves, holds, or refunds funds
• Build shared security building blocks (permissions, caller-scoped reads with field allowlists, audit trails, secrets handling, rate and abuse controls) so teams reuse them instead of reinventing them
• Review changes for security risk and help teams adopt secure-by-default patterns
• Use AI-assisted tooling to review code, enumerate attack paths, and triage findings faster

Requirements:

• You build the feedback loop for your own judgement: back-tests, regression sets and post-incident checks, because the misses that cost the most looked harmless at first
• You've run security-sensitive systems in production
• You enjoy working with product engineers and can turn a threat model into a change they're glad to make
• You're curious about crypto's adversarial conditions: MEV, mempools, address poisoning, sanctioned and illicit flows
• You write things down: a decision with its evidence, an incident with its timeline, a finding with its severity and owner
• Hands-on full-stack engineering experience: you build, deploy, and maintain production services yourself, including instrumentation, logging, monitoring, and alerting
• 4+ years as a software engineer building and running production systems, with a real interest in security (you don't need a security title)
• Strong TypeScript, and comfort across the stack: backend services, databases, and small internal UIs; you can also review other people's code for security flaws
• Distributed-systems correctness: queues, retries, idempotency, race conditions, and unit or decimal boundaries, and the habit of asking what happens when a response is lost or a job runs twice
• Experience building or operating detection, screening, fraud, or abuse-prevention systems, and measuring them against ground truth: precision, recall, and the cost of each kind of error
• On-chain transaction analysis on EVM chains: receipts, logs, block ordering, pool mechanics, and the tooling to trace funds and cluster wallets
• Experience operating LLM-based automation in production: evals, regression sets, and prompt or rule changes treated with the same discipline as code
• Containers and cluster deployment: you can land a service in a Kubernetes cluster with its secrets in the secret store, not on a personal account
• You can read Solidity well enough to judge whether an automated finding against a contract is real
• Experience threat modeling and running security reviews of new features with product teams
• Familiarity with secrets management, identity and access, auditability, and safe handling of side effects
• Strong written communication for incident write-ups and partner or compliance questions; you've written a postmortem that changed a system
• Experience with Rust (we use a little of it, and you'll read more than you write)
• Smart contract auditing, wallet security, or deeper MEV and mempool experience
• Experience with AML, sanctions, or wallet-risk vendors and the integrations around them
• Experience building indexers or block-level tooling
• Experience in payments, exchanges, or another high-stakes domain
• Applied offensive mindset: you've reproduced an exploit against your own systems, written a proof of concept from a vague report, or run purple-team exercises, and you can walk a finding from the data it exposes to what an attacker would actually do with it
• Awareness of security trends and industry-specific threats