Full-Stack Engineer; Security

Relay is a cross-chain payments protocol that provides instant, low-cost cross-chain bridging, swaps, and transactions. We're the fastest and cheapest way to bridge and transact across chains, serving over 5 million users who have completed 59+ million transactions with $6+ billion in volume across 85+ chains.

Relay is a cross-chain payments protocol that provides instant, low-cost cross-chain bridging, swaps, and transactions. We're the fastest and cheapest way to bridge and transact across chains, serving over 5 million users who have completed 59+ million transactions with $6+ billion in volume across 85+ chains.

Our mission is to make transacting across chains as fast, cheap, and reliable as online payments. We are building the core infrastructure to abstract chains from end user payments, enabling the next billion users to experience the benefits of blockchain without the UX burdens.

We're hiring a full-stack engineer who cares deeply about security to work side by side with our Head of Security, who leads security ey moves through our systems 24/7, and attackers, from address poisoners to MEV searchers, are watching the same flows we are. Your job is to make Relay a hard target and to make security something product teams can build in, not bolt on.

Development runs in containers. Production access is read-only by default, with a written path for state-changing actions. Decisions are recorded with their evidence and reviewed later. We lean on AI-assisted tooling, including our own audit agents, and expect you to extend it rather than start over.

In this role, you'll own several production security systems end to end, each of which is a detection or denial control, and you'll partner with product engineers to ship security features that users and integrators can see and trust. This is an individual contributor, hands-on full-stack engineering role. You'll write code every day, deploy it, and run it in production: building services and the tools and interfaces around them, instrumenting them, setting up monitoring and alerts, and being on call for what you ship.

• Own the service that screens wallet addresses before and during transactions: verdict quality, caching and rescreening behaviour, latency, and uptime
• Recommend and integrate risk vendors and data sources, and decide at which stage of a transaction (quote, deposit, fill, refund) and on which chains and address roles (sender, recipient, intermediary) each one applies
• Make blocking decisions explainable: clear error codes and messages for integrators, and auditable reports of what was blocked and why
• Build the override and watchlist tooling around the service with caller authorisation, confirmation steps, and an audit trail
• Handle partner and compliance requests about screening coverage, including blocked-address reporting
• Keep the fail-closed guarantees honest across every flow that moves funds, including refunds, and prove it with tests

• Turn the tracker into a production system that detects sandwich attacks and other MEV extraction against our users' transactions, in near real time
• Measure it: precision and recall against labelled cases, per chain, with the back-test suite in CI
• Quantify impact by chain, route, and integrator, and trace attacks back to where a transaction became visible
• Work with Solving, Infrastructure and Protocol engineers to design mitigations, such as private submission, routing changes, and slippage guidance, and measure whether they work
• Run investigations with our Head of Security when an incident is live and write up what happened and what changed

• Own Vigil as a product for our engineers: keep it reliable, keep its checks current, and decide what it audits next
• Treat it as what it is, an LLM-driven audit harness: prompt and rule changes are production changes, every false-positive rule carries evidence, and a regression set keeps it honest
• Keep findings triage accurate and actionable, with clear severity, ownership, and a path from finding to fix (including delegation to our internal AI agent and Linear tickets)
• Cut noise and false positives so teams trust Vigil's findings and act on them
• Extend Vigil as our systems and threats change, feed incidents back into it, and make sure its findings feed the screening service, the sandwich tracker, and product security work