Frontend Engineer

Who we are

RedCarbon builds AI agents for cybersecurity. Think of them as virtual colleagues that join a Security Operations Center and take on the work that burns analysts out: triaging the endless stream of alerts, investigating incidents, hunting for threats, writing the report at the end. The humans keep what needs a human: judgement, decisions, the call to the customer at 2am.

We are an Italian company with our HQ in Turin, remote since day one, and we closed a €3M Series A in 2025. Our customers trust us with their security, which is a polite way of saying that "it works on my machine" is not an option here.

We are a bit crazy. We put a hacking challenge in front of our application form, and a pixel-art mascot in our job posts. You are about to meet him.

But we are dead serious about the engineering. We aim for a technical bar that is very, very high, and we are AI-first: we build AI products, and we build them with AI, every day, on purpose.

So we don't hire people to turn detailed requirements into code. We hire engineers who start from a problem, understand it, question the assumptions, pick a reasonable solution, ship it, and check that it actually solved the problem. You don't need to know our whole stack on day one. You need solid fundamentals, and to learn fast.

The role

We're looking for a frontend engineer who builds for the analyst, not for the ticket.

Our users are security analysts working side by side with AI agents. They look at incidents, investigations and reports that an agent drafted, they decide what to trust, and they do it under pressure. As a Frontend Engineer you build the interfaces where that happens, and you make inherently hard things feel simple.

What you'll do

Build data-dense interfaces: incident views, investigation timelines, dashboards, the screens analysts live in all day.
Build complex editors: a visual editor for security playbooks and an editor for the reports our agents write.
Evolve our design system, where code is the source of truth.
Ship end to end, from the GraphQL query to the pixel, and occasionally the mobile app. Then follow it in production: the errors real users hit, and how fast it really is on their machines.
Care about the details: performance, accessibility, and what the analyst sees at 2am when something is on fire.
Work with our threat analysts to see how they actually use the screens, and turn that into the next iteration.

The problems you'll solve

An incident with thousands of events has to fit on one screen and still tell a story the analyst can follow.
An agent drafted the report, the analyst signs it. The interface has to show what the agent is sure of, what it is guessing, and where the evidence is.
Every string can be hostile. Alert titles, log lines and agent output carry content an attacker controls: they render as text, never as code.
Every customer gets their own theme, from one design system, without forking a single component.

What we're looking for

Must have

React and TypeScript, in depth.
Web fundamentals: the DOM, how the browser renders, accessibility, HTTP, browser security. Frameworks change; these don't.
Strong on tests: Vitest, Testing Library, Playwright. You test what the user sees and does, not the implementation details.
You care about UX, and you push back when a design doesn't work for the person using it.
You have made a slow interface fast, and you measured it before and after.

Nice to have

We use these every day. You'll learn the ones you don't know yet.

The TanStack ecosystem (Start, Router, Query, Form); Next.js or another modern framework counts.
GraphQL clients and code generation.
Tailwind CSS.
Design systems and design tokens; Storybook, with visual and accessibility tests.
Complex editors: React Flow, Monaco, TipTap.
Data visualization.
Mobile with Capacitor.
An eye for design.

Your first months

First week: ship a UI improvement that an analyst asked for, and show it to them.
First month: build a full feature, from the GraphQL query to the tests, in the incident view or the dashboards.
First three months: own an area of the product (the playbook editor, the reports, the design system) and propose where it goes next.
After one year: you are better at something that matters to you, technical or not, and you can prove it. That's what the growth budget is for, and we'll look at it together.

For every role

You live in Italy. We hire in Italy only, for now.
Fluent Italian and good English. Code and docs are in English; calls are usually in Italian.
You take tests seriously. A feature without tests is a draft. Code reaches review when its author is convinced it works, not so that someone else can find out whether it does.
You use AI to think better, not to stop thinking. AI raises the floor; it doesn't raise the ceiling for you. Use it a lot, challenge its output, and own what you ship: "Claude wrote it" is never an excuse.
Big plus: you are visible. Interesting things on GitHub, talks at conferences or meetups, posts people actually read. Put the links in your CV.
Plus: a degree in Computer Science or a related field. Nice, not required: show us what you built.
Plus: you know some security. If you don't, we'll teach you; it's contagious.

Mid or senior?

Both, and we don't count years. A mid-level engineer ships features end to end in their area, with little guidance, and asks for help before being stuck becomes a habit. A senior engineer has owned a system in production and lived with their own decisions, sees problems before they become tickets, and makes the people around them better.

At every level we expect the same two things: you learn fast, and you take responsibility for your work. The autonomy grows with experience; the initiative has to be there from day one.

Is this for you?

If you have the fundamentals but not every nice-to-have, apply anyway: tools are learnable, and we'll teach you ours. If you'd rather get detailed tickets and someone to tell you when you're done, we're probably not the right place. No hard feelings.

How we think about engineering

Writing code is only part of the job, and with AI writing more of it every day, it's less and less what sets an engineer apart. What does: understanding the problem you're solving, questioning assumptions, exploring alternatives, and taking responsibility for the outcome.

We value curiosity over certainty, evidence over ego, and impact over activity.

Ownership means owning the problem, not falling in love with your solution. Sometimes the right thing is to push through a difficult problem. Sometimes it's to admit that the original decision was wrong and change direction. Knowing the difference matters, and changing your mind when the evidence changes is a strength here, not a loss of face.

We give people context, trust, and room to make decisions. We don't expect you to get everything right; we expect you to learn, take initiative, and grow. The team will help you, a lot, but it won't do your thinking for you.

We care about what you achieve, not how many hours you spend looking busy.

And we want to enjoy building things together. Great engineering and having fun aren't mutually exclusive.

How we work

We are agile, in the original sense of the manifesto, with security by design and by default on top. As an engineering team, we value:

people and trust over processes and controls;
real impact over plans and documentation;
understanding the customer's problem over executing the spec;
learning and adapting over following the original plan;
security as a design choice over checking it at the end;
growing together over excelling alone.

The things on the right matter. When we have to choose, we choose the ones on the left.

In practice:

Simplicity over virtuosity. Complexity is a debt, clarity is an asset. When in doubt, the simplest thing.
Ownership, not hand-offs. Shipping is not passing the ball. You follow your work until it really works in production, and you fix it if it doesn't.
Decide, write it down, revisit it. The people closest to the problem make the call, and write down why: that's what the ADRs are for. When the evidence changes, the decision changes too. A superseded ADR means we learned something, not that someone failed.
Remote, not isolated. Writing well is part of the job: we don't have a hallway, we have text. And we meet in person regularly, because some things remote can't give you.
Mistakes are fine, repeating them isn't. A deploy that breaks something happens. The same deploy breaking the same thing three times is not "iterating".
Cross the borders. Backend people touch the frontend, AI people learn the security domain, everyone cares about the analyst on the other side of the screen.

What we offer

A competitive salary: €45k–70k gross a year (RAL), depending on your level. The range is indicative: if you are truly exceptional, we'll talk numbers above it.
Full-time, permanent contract, CCNL Commercio, with health insurance.
Full remote from anywhere in Italy. We do about 95% of the work remotely; the rest is alignment days and company retreats.

A MacBook Pro. It's what we all work on.
An AI subscription for everyone. Use it, a lot.
Flexible hours, holidays managed on trust, zero micro-management.
Growth budget: time for learning, courses and certifications, internal tech talks, and conferences paid for, even more so if you are the one on stage.
Meal vouchers.

How to apply

There is no "send us your CV" form here. To apply, you have to hack the site.

The application form is behind a short challenge: a few puzzles that a curious developer solves with the browser devtools, a terminal and some patience. It's the same for every role. Solve it, then send us your CV and your GitHub profile. If you like the challenge, you'll probably like the job.

What happens next

An intro call with your future manager and our Product Manager: who we are, who you are, what you are looking for.
One or two technical interviews with the engineers you would work with.
A final interview with our CTO, and then an offer.