Lead Engineer, Patchstack
+ ESOP
Security for third-party component vulnerabilities
Job no longer available
Security for third-party component vulnerabilities
21-100 employees
Job no longer available
+ ESOP
21-100 employees
Company mission
Patchstack's mission is to make open-source safer.
Role
Who you are
- 8+ years of software engineering experience, with at least 2 years leading or owning delivery for a small team (formal title not required — real ownership is)
- Strong backend/full-stack capability with Laravel/PHP, API design, and pragmatic system design
- Experience designing and operating CI/CD pipelines, testing strategies, and observability tooling
- High standards on security, performance, and maintainability
- Track record of shipping in short cycles with a strong quality bar (tests, reviews, CI/CD discipline)
- Comfort and curiosity with AI-assisted development — you actively use tools like Cursor, Copilot, Claude, or similar to move faster
- Excellent written communication: you can document decisions, write clear specs, and align stakeholders asynchronously
- Comfort with ambiguity: you can define the path, not wait for perfect specs
- Interest in the security domain is a strong plus — you don't need to be a security researcher, but curiosity about vulnerabilities, threat intelligence, and the open-source ecosystem will help you thrive. You should care about building for builders — often non-technical people using no-code, low-code, or AI-assisted tools who need protection without needing to understand CVEs
- Experience in a small, scaling company (not just big-co) is a plus — you know how to build process without bureaucracy
What the job involves
- As a Lead Engineer, you'll lead a small squad (typically 3 engineers) to deliver a clear mission end-to-end: setting direction, making pragmatic technical decisions, and ensuring the team ships reliably
- This is a hands-on squad leadership role: you will write code, review code, own architecture choices, and be accountable for outcomes
- You'll partner closely with Product (PM) and Design, and coordinate where needed with Security Research and Ops/Infra
- In our model, squads are built around missions — Flow (Industrialisation) and Ecosystem (Distribution), as described in the pipeline above
- Your exact squad mission will be confirmed during hiring, but the leadership expectations are consistent across both
- Squad outcomes & delivery leadership
- Own your squad's mission and delivery cadence: define milestones, ensure steady shipping, and remove blockers
- Translate high-level goals into a delivery plan: scope, sequencing, trade-offs, and risks
- Drive a high-quality execution loop: clear tickets/specs, small PRs, fast reviews, strong release habits
- Maintain a predictable operating rhythm: planning, weekly goals, retros, and continuous improvement
- Technical direction & architecture
- Make and communicate pragmatic architectural decisions, guided by our technical principles: safe, reversible actions over brittle one-way changes; explainable decisions over opaque scoring; and a single intelligence loopacross multiple delivery surfaces
- Set standards for code quality, testing strategy, observability, and performance
- Use ADRs when decisions have long-term impact; ensure the "why" is documented and shared
- Own technical debt management: pay it down deliberately while maintaining delivery speed
- Leverage AI tools and automation to accelerate development, testing, and operational workflows — and set the standard for the squad
- Contribute to closing the feedback loop: ensuring production telemetry and partner signals flow back to inform research priorities and pipeline quality
- Hands-on engineering
- Build and maintain Laravel-based services and web applications (plus supporting tooling/services)
- Ship secure, testable, performance-aware code; keep production stable
- Lead by example in code reviews, refactoring, and incident response when needed
- Experiment with new tools, frameworks, and AI-assisted development practices — validate what works and share learnings
- Collaboration & cross-functional alignment
- Partner with Product and Design to shape solutions early (not just implement tickets)
- Coordinate with Security Research where domain knowledge is needed to ship correct intelligence flows and mitigation-related work
- Work with Ops/Infra on reliability, scaling, deployments, and platform evolution
- People leadership (small-team, high impact)
- Create clarity for your squad: who owns what, what "done" means, and how quality is measured
- Coach engineers through pairing, reviews, and feedback — raising the bar without creating bureaucracy
- Support hiring and onboarding when your squad grows
- Success in the first 90 days
- You've established a clear squad delivery rhythm (planning, review, release)
- You've shipped meaningful production outcomes aligned to the squad mission
- The codebase areas your squad touches are measurably healthier: clearer ownership, improved tests/observability, fewer recurring issues
- Stakeholders trust your squad's predictability and your decision-making
- How we measure performance
- We measure through both outcomes and behaviours:
- Delivery health: DORA metrics (lead time, deploy frequency, change failure rate, MTTR), cycle time, and PR throughput
- Engineering quality: test coverage on critical paths, architecture clarity, measurable reduction in recurring bugs and toil
- Team impact: peer feedback on clarity, collaboration, review quality, and evidence the squad is stronger because of your leadership
Our take
Cybersecurity is always getting more complex, with developers having to juggle all sorts of considerations to make sure their creations are not vulnerable to attack. Patchstack is a company that simplifies an important part of this picture, by enabling web developers to secure web apps from third-party component vulnerabilities.
Patchstack works by detecting and prioritising vulnerabilities and automating the response to the most potent threats. A stand-out feature is the speed at which it learns about new threats. According to the company, it can protect its users up to 48 hours before its competition, because it is the exclusive report for hundreds of ethical hackers.
Patchstack's popularity is a testament to its value, with the platform being the official security point of contact for 300+ plugins. It is also well-funded, with the latest round going towards product development and the building out of its sales and marketing team.
Steph
Company Specialist at Welcome to the Jungle
Company
Funding (2 rounds)
Sep 2024
$5m
SERIES A
Oct 2021
$4.5m
GRANT
Total funding: $9.5m
Company benefits
- Great people - Work with a super passionate team with shared values
- Full remote - Prefer a sick battle-station at home or love travelling – up to you
- Personal growth - We encourage and support our team to learn something new every day
- Make an impact - Work on a product that benefits thousands and help nurture a community
Company HQ
Pärnu, Pärnu County
Leadership
Oliver Sild
(Founder & CEO)Cyber Security Mentor at Tehnopol. Also Co-Founder at Forwardspace, and Co-Founder and Organizer at CTF Pärnu.
Dave J.
(CTO)Previously a PHP Developer and Security Researcher at Technidev, as well as a Website Developer at BlueICT.
Share this job