Full-Stack Engineer (Security)

As a Full-Stack Engineer (Security) at Relay, you'll work side by side with our Head of Security to protect a cross-chain payments protocol handling $6+ billion in volume across 85+ chains and serving over 5 million users. Money moves through our systems 24/7, and your job is to make Relay a hard target and enable product teams to build security in, not bolt it on. This is a hands-on role where you'll own several production security systems end to end, write code every day, deploy it, and run it in production.

What you'll do

• Own the wallet screening microservice: manage verdict quality, caching and rescreening behavior, latency, and uptime; integrate risk vendors and data sources; make blocking decisions explainable with clear error codes and audit trails; build override and watchlist tooling; handle partner and compliance requests; and keep fail-closed guarantees across every fund movement flow
• Own the sandwich-attack tracker: turn it into a production system that detects MEV extraction against user transactions in near real time; measure precision and recall per chain with back-test suites in CI; quantify impact by chain, route, and integrator; work with Solving, Infrastructure, and Protocol engineers to design and measure mitigations; and run live incident investigations
• Maintain Vigil, our internal LLM-driven audit tool: keep it reliable and current; treat prompt and rule changes as production changes with evidence backing each one; keep findings triage accurate and actionable; cut noise and false positives so teams trust and act on Vigil's findings; and extend it as systems and threats change
• Build the detection and response loop: run daily loss reviews as automated jobs with alerting; own monitors that catch mispricing, unexpected refunds, and quote deviations; build watchlist and early-warning pipelines to deny exit rails to proceeds of third-party hacks within the hour; write postmortems and turn lessons into checks, monitors, or rules
• Build security features with product teams: threat-model new features at design time, especially anything that moves, holds, or refunds funds; build shared security building blocks so teams reuse them instead of reinventing; review changes for security risk; and use AI-assisted tooling to review code and triage findings faster

What you bring

• Hands-on full-stack engineering experience: you build, deploy, and maintain production services yourself, including instrumentation, logging, monitoring, and alerting
• 4+ years as a software engineer building and running production systems, with a genuine interest in security (you don't need a security title)
• Strong TypeScript and comfort across the stack: backend services, databases, and small internal UIs; you can also review code for security flaws
• Distributed-systems correctness: queues, retries, idempotency, race conditions, and the habit of asking what happens when a response is lost or a job runs twice
• Experience building or operating detection, screening, fraud, or abuse-prevention systems, and measuring them against ground truth: precision, recall, and the cost of each kind of error
• On-chain transaction analysis on EVM chains: receipts, logs, block ordering, pool mechanics, and the tooling to trace funds and cluster wallets
• Experience operating LLM-based automation in production: evals, regression sets, and prompt or rule changes treated with the same discipline as code
• Containers and cluster deployment: you can land a service in a Kubernetes cluster with its secrets in the secret store
• You can read Solidity well enough to judge whether an automated finding against a contract is real
• Experience threat-modeling and running security reviews of new features with product teams
• Familiarity with secrets management, identity and access, auditability, and safe handling of side effects
• Strong written communication for incident write-ups and partner or compliance questions; you've written a postmortem that changed a system
• You build the feedback loop for your own judgement: back-tests, regression sets, and post-incident checks
• You enjoy working with product engineers and can turn a threat model into a change they're glad to make
• You're curious about crypto's adversarial conditions: MEV, mempools, address poisoning, sanctioned and illicit flows
• You're comfortable being on call for 24/7 financial infrastructure and calm during live incidents

Nice to have

• Experience with Rust (Relay uses some of it, and you'll read more than you write)
• Smart contract auditing, wallet security, or deeper MEV and mempool experience
• Experience with AML, sanctions, or wallet-risk vendors and the integrations around them
• Experience building indexers or block-level tooling
• Experience in payments, exchanges, or another high-stakes domain
• Applied offensive mindset: you've reproduced an exploit against your own systems, written a proof of concept from a vague report, or run purple-team exercises
• Awareness of security trends and industry-specific threats

What we offer

• Competitive base salary
• Equity package
• Comprehensive health benefits
• Unlimited PTO policy with encouraged minimum
• Remote-first culture with emphasis on collaboration, communication, and flexibility

About Relay

Relay is a cross-chain payments protocol providing instant, low-cost cross-chain bridging, swaps, and transactions. The platform serves over 5 million users who have completed 59+ million transactions with $6+ billion in volume across 85+ chains, and is building core infrastructure to abstract chains from end-user payments.