Full-Stack Engineer (Security)

As a Full-Stack Engineer (Security) at Relay, you'll work alongside the Head of Security to build and run production security systems for a cross-chain payments protocol serving over 5 million users with 59+ million transactions and $6+ billion in volume across 85+ chains. Money moves through Relay 24/7, and you'll make the protocol a hard target against address poisoners, MEV searchers, and other attackers, embedding security into how product teams build rather than bolting it on after the fact.

What you'll do

• Own the wallet screening microservice end to end: verdict quality, caching and rescreening behavior, latency, and uptime; recommend and integrate risk vendors and data sources; decide which stages of a transaction and which chains and address roles each applies to; make blocking decisions explainable with clear error codes and audit trails; build override and watchlist tooling with caller authorization and confirmation steps; handle partner and compliance requests about screening coverage; keep fail-closed guarantees across every fund-moving flow, including refunds, proven with tests
• Own the sandwich-attack tracker: turn it into a production system that detects sandwich attacks and MEV extraction against users' transactions in near real time; measure precision and recall against labelled cases per chain with a back-test suite in CI; quantify impact by chain, route, and integrator; work with Solving, Infrastructure and Protocol engineers to design and measure mitigations such as private submission, routing changes, and slippage guidance; run live incident investigations with the Head of Security and write postmortems
• Maintain Vigil, the internal LLM-driven audit harness: keep it reliable and its checks current; decide what it audits next; treat prompt and rule changes as production changes; keep findings triage accurate and actionable with clear severity, ownership, and a path to fix; cut noise and false positives so teams trust and act on findings; extend Vigil as systems and threats change and feed incidents back into it
• Build the detection and response loop: run the daily loss review as an automated job with alerting; own monitors that catch mispricing, unexpected refunds, and fills deviating from quotes; build the watchlist and early-warning pipeline that denies exit rails to proceeds of third-party hacks within the hour; write postmortems in your domain and turn lessons into checks, monitors, or rules
• Build security features with product teams: threat-model new features at design time, especially anything that moves, holds, or refunds funds; build shared security building blocks like permissions, caller-scoped reads with field allowlists, audit trails, secrets handling, and rate and abuse controls; review changes for security risk and help teams adopt secure-by-default patterns; use AI-assisted tooling to review code, enumerate attack paths, and triage findings faster

What you bring

• 4+ years as a software engineer building and running production systems, with a genuine interest in security (you do not need a security title)
• Hands-on full-stack engineering experience: you build, deploy, and maintain production services yourself, including instrumentation, logging, monitoring, and alerting
• Strong TypeScript and comfort across the stack (backend services, databases, and small internal UIs); you can review others' code for security flaws
• Distributed-systems correctness: understanding of queues, retries, idempotency, race conditions, and unit or decimal boundaries; the habit of asking what happens when a response is lost or a job runs twice
• Experience building or operating detection, screening, fraud, or abuse-prevention systems, and measuring them against ground truth (precision, recall, cost of each error type)
• On-chain transaction analysis on EVM chains: receipts, logs, block ordering, pool mechanics, and tooling to trace funds and cluster wallets
• Experience operating LLM-based automation in production: evals, regression sets, and prompt or rule changes treated with the same discipline as code
• Containers and cluster deployment: you can land a service in a Kubernetes cluster with secrets in the secret store
• Ability to read Solidity well enough to judge whether an automated finding against a contract is real
• Experience threat-modeling and running security reviews of new features with product teams
• Familiarity with secrets management, identity and access, auditability, and safe handling of side effects
• Strong written communication for incident write-ups and partner or compliance questions; you've written a postmortem that changed a system
• You build feedback loops for your own judgement through back-tests, regression sets, and post-incident checks
• You've run security-sensitive systems in production
• You work well with product engineers and can turn a threat model into a change they're glad to make
• You're curious about crypto's adversarial conditions: MEV, mempools, address poisoning, sanctioned and illicit flows
• You're comfortable being on call for 24/7 financial infrastructure and calm during live incidents
• You document decisions with their evidence, incidents with their timeline, and findings with their severity and owner

Nice to have

• Experience with Rust (Relay uses a little of it; you'll read more than you write)
• Smart contract auditing, wallet security, or deeper MEV and mempool experience
• Experience with AML, sanctions, or wallet-risk vendors and their integrations
• Experience building indexers or block-level tooling
• Background in payments, exchanges, or another high-stakes domain
• Applied offensive mindset: you've reproduced an exploit against your own systems, written a proof of concept from a vague report, or run purple-team exercises; you can trace a finding from the data it exposes to what an attacker would actually do with it
• Awareness of security trends and industry-specific threats

What we offer

• Competitive base salary
• Equity package
• Comprehensive health benefits
• Unlimited PTO policy with encouraged minimum
• Remote-first culture with emphasis on collaboration, communication, and flexibility

About Relay

Relay is a cross-chain payments protocol providing instant, low-cost cross-chain bridging, swaps, and transactions. With over 5 million users completing 59+ million transactions and $6+ billion in volume across 85+ chains, Relay is building core infrastructure to abstract chains from end-user payments, enabling the next billion users to benefit from blockchain without UX friction.