Senior Software Engineer (AppSec)

About us

Trigger.dev is the platform for running reliable AI agents and workflows. Developers use it to build, deploy, and scale production systems with built-in tools for orchestration, scheduling, monitoring, and debugging.

Our Cloud product is a managed service where we deploy our users’ code and auto-scale from zero to millions of executions. Today, we serve thousands of teams building AI apps and agents, handling hundreds of millions of executions per month.

About the role

You’ll own security at Trigger.dev: our infrastructure, our app, the runtime that runs our users’ code, and the secrets they trust us with.

Some of our customers let their own users run code on Trigger.dev (think coding agents running whatever instructions they’re given). That code must never reach our systems or our customers’ systems. Keeping it contained is a feature we ship, so this is a product engineering role as much as a security one.

About half to three quarters of your time will be backend engineering. The rest is hunting for problems and fixing them. When you find something, you own the fix. You’ll set your own priorities and work with others when necessary.

We’re looking for an application security (AppSec) engineer who builds: a senior backend engineer who brings a security mindset to everything they ship.

What you’ll do

• Sandbox and runtime security. Design and harden the environments that isolate untrusted user code. This is the core of the role.

• Security features for customers. Build things like end-to-end encrypted secrets, log redaction, private networking, and runtime hardening.

• Automated offensive testing. Use AI tools to attack our own systems on a schedule, find weak spots, and fix them. Bring in outside pen testers when it’s worth it.

• Detection and response. Build monitoring and alerting for suspicious activity, improve our security observability, and lead the response when something needs a look.

• Vulnerability management. Run scanning and triage, own our vulnerability disclosure program, and handle incoming reports.

• Automated quality. Own our security PR reviews, automated scans, fixes, and triage.

• Write it down. Document how we do security so the rest of the team can answer customer questions with confidence.

• Security habits. Help the engineering team build secure habits with reviews, docs, and light guardrails.

Like everyone at Trigger.dev, you’ll also help in our Discord and GitHub community, write docs, and create content like blog posts, code examples, and videos.

What we’re looking for

• Senior backend engineer. You design and ship production backend systems yourself.

• AppSec experience. You’ve done hands-on application security work, such as secure code review, threat modelling, pen testing, CTFs or bug bounties. You don’t need a security job title or to have run a security team.

• Cloud operations. You’ve run production systems in the cloud.

• Multi-tenant systems. You’ve built or secured systems where many customers share the same infrastructure.

• TypeScript. You’re comfortable working in it. Our codebase also uses Go and Rust.

• AI-forward. You use AI tools to automate testing, detection, and defense.

• Startup pace. You’ve worked somewhere a step or two ahead of where we are, so you know what good looks like at our size.

• Owner’s mindset. You take work off the team’s plate and fix what you find.

• On call. Reliability and security response are shared across the team.

• In-person time. You’re open to team events a few times a year.

You’ll stand out if you have

• Built or hardened sandboxes: containers, microVMs, gVisor, Firecracker, WASM, or similar.

• Secured platforms where customers have their own customers.

• A track record in bug bounties or CTFs.

• Contributed to open source.

• Worked at a developer tools, infrastructure, or open source company.

• Experience with Go or Rust.

Benefits

• Compensation and equity. Generous, transparent pay, plus equity so everyone shares in the company’s success.

• Async working. Need a heads-down day or a meeting-free day? No problem.

• Home office. We help with equipment so you’re as productive at home as in the office.

• Vacation. 25 days plus national holidays, sick leave, and generous parental leave.

• Training budget. An annual budget for books, courses, or an Audible subscription.

• Pension. Join our company scheme, or we’ll pay into your private pension.

Our values

• We’re proud to be open source. We believe in the open source community and in building a great free-to-use product.

• We ship uncomfortably fast. Moving fast is key for a startup. We’re pragmatic about what we build and when.

• We work autonomously. We decide as a team what will help our customers most, and prioritize from there.