HimalayasHimalayas logo
PatchstackPA

Lead Engineer

Patchstack is a cybersecurity company that provides a vulnerability management and mitigation platform for WordPress developers and agencies, focusing on the complete lifecycle of open-source security.

Patchstack

Employee count: 11-50

United Kingdom only

Stay safe on Himalayas

Never send money to companies. Jobs on Himalayas will never require payment from applicants.

As a Lead Engineer, you'll lead a small squad (typically 3 engineers) to deliver a clear mission end-to-end: setting direction, making pragmatic technical decisions, and ensuring the team ships reliably.

This is a hands-on squad leadership role: you will write code, review code, own architecture choices, and be accountable for outcomes. You'll partner closely with Product (PM) and Design, and coordinate where needed with Security Research and Ops/Infra.

In our model, squads are built around missions — Flow (Industrialisation) and Ecosystem (Distribution), as described in the pipeline above. Your exact squad mission will be confirmed during hiring, but the leadership expectations are consistent across both.

Tech stack

  • Backend: Laravel / PHP (primary), with supporting services and tooling
  • Frontend: Vue.js / Inertia.js, ShadCN
  • Infrastructure: AWS, Docker, GitHub Actions CI/CD
  • Data & intelligence: MySQL, automated vulnerability pipelines
  • AI tooling: Claude, MCP integrations, AI-assisted development workflows
  • Practices: ADRs, small PRs, trunk-based development, feature flags, observability-first

Responsibilities

Squad outcomes & delivery leadership

  • Own your squad's mission and delivery cadence: define milestones, ensure steady shipping, and remove blockers.
  • Translate high-level goals into a delivery plan: scope, sequencing, trade-offs, and risks.
  • Drive a high-quality execution loop: clear tickets/specs, small PRs, fast reviews, strong release habits.
  • Maintain a predictable operating rhythm: planning, weekly goals, retros, and continuous improvement.

Technical direction & architecture

  • Make and communicate pragmatic architectural decisions, guided by our technical principles: safe, reversible actions over brittle one-way changes; explainable decisions over opaque scoring; and a single intelligence loopacross multiple delivery surfaces.
  • Set standards for code quality, testing strategy, observability, and performance.
  • Use ADRs when decisions have long-term impact; ensure the "why" is documented and shared.
  • Own technical debt management: pay it down deliberately while maintaining delivery speed.
  • Leverage AI tools and automation to accelerate development, testing, and operational workflows — and set the standard for the squad.
  • Contribute to closing the feedback loop: ensuring production telemetry and partner signals flow back to inform research priorities and pipeline quality.

Hands-on engineering

  • Build and maintain Laravel-based services and web applications (plus supporting tooling/services).
  • Ship secure, testable, performance-aware code; keep production stable.
  • Lead by example in code reviews, refactoring, and incident response when needed.
  • Experiment with new tools, frameworks, and AI-assisted development practices — validate what works and share learnings.

Collaboration & cross-functional alignment

  • Partner with Product and Design to shape solutions early (not just implement tickets).
  • Coordinate with Security Research where domain knowledge is needed to ship correct intelligence flows and mitigation-related work.
  • Work with Ops/Infra on reliability, scaling, deployments, and platform evolution.

People leadership (small-team, high impact)

  • Create clarity for your squad: who owns what, what "done" means, and how quality is measured.
  • Coach engineers through pairing, reviews, and feedback — raising the bar without creating bureaucracy.
  • Support hiring and onboarding when your squad grows.

Requirements

  • 8+ years of software engineering experience, with at least 2 years leading or owning delivery for a small team (formal title not required — real ownership is).
  • Strong backend/full-stack capability with Laravel/PHP, API design, and pragmatic system design.
  • Experience designing and operating CI/CD pipelines, testing strategies, and observability tooling.
  • High standards on security, performance, and maintainability.
  • Track record of shipping in short cycles with a strong quality bar (tests, reviews, CI/CD discipline).
  • Comfort and curiosity with AI-assisted development — you actively use tools like Cursor, Copilot, Claude, or similar to move faster.
  • Excellent written communication: you can document decisions, write clear specs, and align stakeholders asynchronously.
  • Comfort with ambiguity: you can define the path, not wait for perfect specs.
  • Interest in the security domain is a strong plus — you don't need to be a security researcher, but curiosity about vulnerabilities, threat intelligence, and the open-source ecosystem will help you thrive. You should care about building for builders — often non-technical people using no-code, low-code, or AI-assisted tools who need protection without needing to understand CVEs.
  • Experience in a small, scaling company (not just big-co) is a plus — you know how to build process without bureaucracy.

Success in the first 90 days

  • You've established a clear squad delivery rhythm (planning, review, release).
  • You've shipped meaningful production outcomes aligned to the squad mission.
  • The codebase areas your squad touches are measurably healthier: clearer ownership, improved tests/observability, fewer recurring issues.
  • Stakeholders trust your squad's predictability and your decision-making.

How we measure performance

We measure through both outcomes and behaviours:

  • Delivery health: DORA metrics (lead time, deploy frequency, change failure rate, MTTR), cycle time, and PR throughput.
  • Engineering quality: test coverage on critical paths, architecture clarity, measurable reduction in recurring bugs and toil.
  • Team impact: peer feedback on clarity, collaboration, review quality, and evidence the squad is stronger because of your leadership.

Benefits

  • Competitive salary + meaningful ESOP — we want you to have real skin in the game.
  • Remote-first — work from anywhere with reasonable overlap with EU timezones.
  • Company provided laptop
  • High autonomy — you'll own the mission, not just execute tickets.
  • AI tooling budget — we invest in tools that make engineers faster.
  • A team that ships — small, senior, no filler. Everyone here is a builder.
  • 38 days a year paid time off (including public holidays)
  • Co-working space membership or WFH equipment for home-office
  • Quarterly health benefits allowance

Note that outside Estonia all of our roles are contractor positions.

About the job

Apply before

Posted on

Job type

Contractor

Experience level

Experience

8 years minimum

Location requirements

Hiring timezones

United Kingdom +/- 0 hours

About Patchstack

Learn more about Patchstack and their company culture.

View company profile

What began as a focused endeavor to secure the open-source world has blossomed into Patchstack, a leading force in web application security. The journey started with a clear and pressing need: to address the rampant vulnerabilities within the WordPress ecosystem, which powers a significant portion of the internet. The founders, recognizing the immense and often overlooked security gaps in third-party plugins and themes, embarked on a mission to create a comprehensive solution. Initially known as WebARX, the company was born from a desire to provide digital agencies and developers with the tools to monitor, protect, and maintain their websites effectively. This early vision was rooted in the understanding that a proactive, rather than reactive, approach to security was paramount. The team's dedication and innovative spirit led them to develop a smart firewall engine capable of shielding websites from a wide array of threats, including the notorious OWASP top 10 vulnerabilities and specific plugin exploits.

The evolution from WebARX to Patchstack marked a significant milestone, reflecting a deeper, more specialized focus on the entire lifecycle of open-source security. This transition wasn't just a name change; it signified a strategic shift towards building a community-powered security model. At the heart of this model is the Patchstack Alliance, a vibrant community of ethical hackers and security researchers who actively discover and report vulnerabilities. This collaborative approach has been instrumental in Patchstack's success, enabling them to become the world's largest discloser of WordPress-related security vulnerabilities. The company's growth has been fueled by strategic investments and recognitions, including a Series A funding round and selection into prestigious programs like the Google for Startups Growth Academy for AI in Cybersecurity. Today, Patchstack stands as a testament to the power of community and innovation, offering a robust platform that not only protects millions of websites but also fosters a more secure and resilient open-source ecosystem for everyone. Their journey is a compelling narrative of identifying a critical problem and relentlessly building a solution that has a tangible, positive impact on the digital world.

Claim this profilePatchstack logoPA

Patchstack

View company profile

Similar remote jobs

Here are other jobs you might want to apply for.

View all remote jobs

Remote companies like Patchstack

Find your next opportunity by exploring profiles of companies that are similar to Patchstack. Compare culture, benefits, and job openings on Himalayas.

View all companies

Find your dream job

Sign up now and join over 100,000 remote workers who receive personalized job alerts, curated job matches, and more for free!

Sign up
Himalayas profile for an example user named Frankie Sullivan