Trail of Bits

Trail of Bits runs a four-stage hiring process that takes roughly three weeks end to end, per its careers page: a 30-minute preliminary screen with a technical recruiter, a 60-minute technical screening with an engineer or hiring manager, a take-home technical assessment benchmarked at about two hours of work with 3 to 7 days to complete it (a security code challenge for engineering roles, a role-relevant scenario for others), and a 90-minute to two-hour final panel interview. All interviews run over Google Meet, and the firm states a hiring decision within five business days of the last interview. The four-stage structure, three-week timeline, and five-day decision window have held since at least 2022, per the firm's own account of its process.

Because the loop runs about three weeks with a multi-day take-home window in the middle, it typically overlaps with whatever else is active in a candidate's search that week. Trail of Bits reviews applications on a rolling, year-round basis rather than a fixed campus season, so the loop can start whenever an application is submitted rather than waiting on an intake date.

Trail of Bits runs two named internship tracks: a paid Summer Internship (June through August) and a shorter Winternship over winter break, each built around a single mentor-guided project rather than a multi-team rotation, per the firm's internship program posts. Interns work inside the firm's live research and engineering teams; recently published intern projects span blockchain and smart-contract tooling, binary analysis, and internal automation, and the firm has published intern work every year from at least 2020 through 2025. Both tracks are advertised as open to remote candidates, with an option to work from the firm's Brooklyn, NY office, per its 2026 summer internship posting.

Each track is a single project rather than a multi-team rotation, and the firm opens and closes every cycle's applications separately rather than running one shared campus deadline, so a candidate needs to track the specific posting rather than assume a fixed annual window.

Trail of Bits built Buttercup, an autonomous AI system for finding and patching vulnerabilities in open-source software, and placed second for a $3 million prize at DARPA's AI Cyber Challenge finals in August 2025, a result independently confirmed by DARPA; Buttercup was open-sourced once the competition closed. The firm is also the original author of Slither, Echidna, and Manticore, security-analysis tools for smart contracts and binaries still in active use across the blockchain-security field, with Slither's design documented in a peer-reviewed paper on arXiv. For an early-career engineer, both facts point the same way: audit and consulting work here sits directly upstream of public research output and competition-grade tooling, rather than staying internal work product that never leaves a client engagement.

Not right now. Trail of Bits has no internship or graduate roles listed today; new postings appear here as the firm opens them.

Applications to Trail of Bits go through the firm's own careers site, one application per posting, each expecting a CV and cover letter written for that role.