Staff Software Engineer, Firewall

Horizon3

8d•$225,000 - $265,000•Remote

About The Position

Horizon3 is hiring a Staff Software Engineer to serve as the hands-on technical lead for the Firewall pod within Precision Defense. The role focuses on building and evolving services and integrations that connect NodeZero with Web Application Firewall (WAF) management platforms, assess policy coverage, and translate validated findings into accurate and safe remediation guidance. The engineer will work with Product, Engineering, AI research, and the Attack team to turn WAF workflows and attack-path evidence into useful, verifiable customer outcomes. The position requires setting the technical direction for the WAF workstream while remaining involved in production code and customer impact from design through operation and iteration. It includes designing reliable integrations across vendor-specific policy models, ensuring recommendations address validated paths without disrupting legitimate traffic, and building durable workflows that handle retries, idempotency, timeouts, and partial failures. Where configuration changes are supported, the role also calls for safety controls such as tenant-scoped authorization, least privilege, precondition checks, auditability, validation and recovery paths, staged rollout, and fast rollback. The Staff Engineer will improve observability, lead design and code reviews, raise engineering standards for quality, testing, security, and operational readiness, and partner across teams to clarify scope and dependencies. The role includes mentoring and leading through influence rather than direct people management, while clearly communicating risks and tradeoffs. Horizon3 is a fully remote company; this role may require up to 10% travel. The position offers a base salary range of $225,000–$265,000 annually, with the exact amount based on location, qualifications, experience, and relevant skills. Full-time employees are eligible for stock options. Benefits include health, vision, and dental insurance for employees and their families, a flexible vacation policy, and generous parental leave.

Requirements

Expert-level proficiency in large-scale Python software development.
At least 8 years of experience leading technical work at Staff, Lead, or comparable scope, including architecture, implementation, and cross-team influence.
Working knowledge of WAF platforms and policy models, such as AWS WAF, Cloudflare, F5, Imperva, FortiWeb, or ModSecurity/OWASP CRS, including rules, managed rule groups, and vendor-specific effects on request inspection and blocking.
Proficiency in another modern backend language such as Go or Rust, or a comparable language.
Experience designing service-oriented systems, APIs, or integrations, including their behavior under failure and partial completion.
Strong systems-design skills and ability to make sound tradeoffs across correctness, reliability, security, and maintainability.
Ability to turn ambiguous product or customer problems into concrete technical plans and deliver outcomes with cross-functional partners.
Clear technical writing and communication skills.
Strong hands-on software engineering skills, including a record of designing, shipping, and operating production backend systems.
Ability to set direction for a workstream, make and explain tradeoffs, and bring other engineers along.
Product-minded judgment to define a shared problem, create a practical technical roadmap, and deliver a valuable first release without blocking future evolution.
Reliability and security mindset that incorporates failure modes, correctness, authorization, auditability, and operational needs into design.
Ability to work effectively across Product, Engineering, research, and customer-facing teams, communicating complex technical decisions to different audiences.
Collaborative technical leadership through design, reviews, mentorship, and clear written decisions.

Nice To Haves

Experience in adjacent areas such as API security, bot management, rate limiting, application security testing (DAST/pentesting), or network firewall platforms and segmentation.
Experience integrating with security or infrastructure platforms whose APIs and policy models vary by vendor.
Experience building security products or systems that assess control coverage, validate attack paths, or produce remediation guidance.
Experience designing safe automation for changes that can affect customer environments, including authorization, audit, validation, and recovery considerations.
Familiarity with cloud environments, containerization, and operating services at scale.
Experience working closely with Product, AI or applied research, or security practitioners to turn domain expertise into customer-facing software.

Responsibilities

Own the technical approach for the Web Application Firewall workstream, from problem framing and design through sequencing, delivery, operation, and iteration.
Design and build reliable integrations with WAF management platforms and their APIs, accounting for vendor differences in policy models and behavior.
Define correctness checks so recommendations address validated attack paths while preserving legitimate traffic and service availability.
Build durable workflows for long-running or resumable operations, including retries, idempotency, timeouts, and partial-failure handling.
Design safety controls for supported configuration changes, including tenant-scoped authorization, least privilege, precondition checks, auditability, validation and recovery paths, staged rollout, and fast rollback.
Build observability that helps engineers and customers understand what the system assessed, what it recommends, and why.
Contribute regularly to production code while shaping architecture, leading design and code reviews, and improving quality, testing, security, and operational readiness.
Partner with Product and adjacent technical teams to clarify scope, sequence work, manage dependencies, and connect technical decisions to customer outcomes.
Mentor engineers and lead through influence rather than direct people management.
Surface risks and tradeoffs early and clearly in writing.
Collaborate with Product, Engineering, AI research, and the Attack team to deliver useful, verifiable customer outcomes.