Mission

Live at the intersection of app runtime & security. Protect applications in a fundamental way so that developers can build great application services and not be constantly looking over their shoulder. BlueRock is changing the landscape of App runtime security.

The role

You will work within the control plane development team on BlueRock's operator consoles: the React front ends that engineers and security teams use to manage large fleets of protected nodes, see what AI agents are actually doing across those fleets, and author the policy that constrains them.

The domain is AI and agentic systems, viewed from the operations and security side. When an agent calls an MCP server, spawns a subagent, runs a shell command in a sandbox, or burns $40 of tokens in an afternoon, our UI is where a human sees it, understands it, and decides what to allow. That means the interesting problems are visibility problems (how do you show a thousand agent sessions so a person can find the one that matters) and control problems, such as how you author an enforcement policy without a mistake taking production down.

The work is mainly done with AI. Claude Code. Cursor, Codex are part of the normal toolchain here for reading unfamiliar code, drafting changes, and reviewing diffs. Getting good at directing it. Knowing what to delegate, what to verify yourself, and how to tell a plausible answer from a correct one — is part of the job and part of what you will get better at.

What the work looks like

You start close to the product, on work that is scoped enough to finish and real enough to matter:

• Fixing UI bugs across the consoles and the Windows, Mac, Linux clients' UI layout and overflow, tooltips and popovers, empty and zero states, things that are technically correct and still confusing.
• Filling in the gaps in a flow, such as navigation, validation, and the guard that stops someone saving a policy draft in a state that makes no sense.
• Building and refining components in our design system, and migrating the apps onto them.
• Data-dense views: dashboards, metric cards, charts, time-range and filter controls over large agent and fleet datasets.
• Shipping behind feature flags, and gating what isn't ready yet.

You will get experience of and work within cloud environments, giving you exposure to the control planes and management platforms that power our systems.

This is how you learn the codebase and earn the room to take on bigger pieces. It is where you start, not where you stay.

Growth path

This is an early-career role, not a low-expectation one. We are hiring for engineering rigor and expecting to move you up quickly. Roughly how that goes:

• First few months: land changes safely. Scoped bugs and small features in the consoles and in our design system. You learn the component library, the theme tokens, the API layer, and how to verify your own work.
• Next: own a surface. Take a feature area end to end: the policy authoring flow, a dashboard, the trace viewer. That includes the design decisions, not just the implementation. You decide what the empty state says, how the progressive disclosure works, what a dense table looks like at 1200px. We will pair you with design where it helps and expect your own judgement where it doesn't.
• Then: pick your depth. Two directions are open, and you choose:

• Design-leaning front end. Interaction and information design for dense operational data: visualization, charting, the shape of the design system itself, contributing patterns other engineers build on.
• Full stack. The UI is the front of a system that runs from an agent on someone's laptop, through the sensors and services that collect and enforce, into a cloud control plane and the management platform on top of it. If full stack is the career you want, the path is real: follow your own features down a layer at a time, into the API, the data layer, and the services behind it. Some of that is TypeScript, some is Rust, and we will support you picking up whatever you need on the job.

Nothing about this is a rigid ladder. It is what we will actively make room for.

Stack

React with TypeScript, Vite, Ant Design plus our own design system (tokens, light and dark themes), GraphQL, charting libraries for the data-dense views, and Vitest and Playwright for tests. Further back it is a mix of TypeScript and we also have applications and services that run on the desktop across Mac, Windows, and Linux, making this a multi-platform, multi-environment setup. Rust services over graph and columnar stores, on open telemetry standards.

You do not need prior experience with all of it. You do need to be comfortable with TypeScript and React and willing to read code before changing it.

What we expect

We are not looking for years on a CV. We are looking for the habits of a careful engineer, which plenty of people have on day one of their first job and some never pick up:

• Diagnose before you change. Find the actual cause, which is usually a layer away from the symptom, and be able to explain why your fix addresses it. A change that makes the symptom disappear is not the same as a fix.
• Small, deliberate diffs. Solve the problem in front of you. Don't refactor adjacent code on the way past, and don't build the abstraction you may need later.
• Fix it in one place. When the same bug shows up in three panels, the fix belongs in the shared component, not copied three times. Knowing where a change belongs is most of the skill.
• Verify, then claim. Run it, look at it, check both themes and a narrow viewport, get types and lint clean, write the test where a test is what proves it. Then say plainly what you checked and what you did not. This applies double to AI-assisted work: you own the diff, whoever drafted it.
• Say when you're unsure. A requirement with two readings is a question, not a guess. Surfacing a problem early is always cheaper than discovering it in review.

Requirements

A computer science or software engineering education, or self-taught work that clearly demonstrates the same rigor. Data structures, testing, version control, and the ability to reason about and own code you did not write.

Working TypeScript and modern React: hooks, composition, state that lives at the right level, and an understanding of why a re-render happens.

CSS that holds up: flexbox and grid, overflow and scroll containers, responsive behaviour, why a tooltip or popover ends up clipped.

Git as a working tool. Branches, readable commits, responding to review without taking it personally.

Careful attention to visual detail. Much of this work is noticing that something is two pixels wrong, or that a label is technically correct and still confusing.

Genuine interest in the AI and agentic space, and in the operational and security questions it creates.

Nice to have

An internship, a substantial personal or open-source project, a component library or design system you have contributed to, GraphQL, charting libraries, Playwright or another E2E framework, design training or a portfolio, or experience with dense data-heavy tooling.

Not required

Years of professional experience. We are comfortable with this being your first or second engineering job. Also not required but nice to have: backend, security, or infrastructure experience, or any knowledge of our domain — fleet management, telemetry, agent observability, policy enforcement. We will teach that.

About BlueRock

BlueRock is a well-funded, early stage cybersecurity company founded by experienced security minded entrepreneurs. Our mission is to change the game in cybersecurity. Attackers are exploiting in hours. The dependency tree is exploding. Developers are drowning in vulnerability debt. BlueRock changes the game, enabling organizations to shift from chasing CVEs and exploits to proactively protecting the foundations of applications and computing, so that developers can build great applications without looking over their shoulders.