About us

Trigger.dev is the platform for running reliable AI agents and workflows. Developers use it to build, deploy, and scale production systems with built-in tools for orchestration, scheduling, monitoring, and debugging.

Our Cloud product is a managed service where we deploy our users' code and auto-scale from zero to millions of executions. Today, we serve thousands of teams building AI apps and agents, handling hundreds of millions of executions per month.

About the position

We're looking for a backend product engineer who loves security - not a security box-ticker. You'll build and own the systems that let Trigger safely run massive volumes of untrusted user code inside our infrastructure, at scale.

Some of our customers let their own users run untrusted code on top of Trigger - think coding agents executing arbitrary instructions. We have to guarantee that code can never break Trigger's systems, or our customers' systems. That makes this partly a product engineering role: building secure sandbox runtimes is a feature we ship, not something bolted on after the fact.

The ideal person here is a backend engineer with genuine offensive-security instincts - someone who naturally gravitates toward hacking, pen testing, and breaking things, and brings that curiosity into how they build. You'll pair strong backend/product instincts with a hacker's mindset.

What you'll be doing

You'll do a variety of things including:

Sandbox and runtime security. Designing and maintaining the secure execution environments that isolate untrusted user code - the core, product-shaped problem at the heart of this role.

Threat detection and incident response. Building monitoring and alerting for suspicious activity, and leading the response when something needs investigating.

Vulnerability management, end to end. Regular scanning and triage, plus AI-assisted security scans run on a quarterly cadence, and triaging incoming disclosures.

Offensive security. Running internal, AI-assisted pen testing, and potentially bringing in external firms for deeper engagements.

PR security review. Adding a security-specific review layer on top of our normal PR process.

SOC 2 and compliance. Mostly done already - this is about ongoing maintenance, not standing it up from scratch.

Vulnerability disclosure process. Owning our vulnerability disclosure program end to end.

Security culture. Helping the wider engineering team build secure habits - reviews, documentation, and pragmatic guardrails rather than heavy process.