About the Role
Own the pipeline that turns raw endpoint telemetry into security intelligence. You'll work at the core of Neo: the ingestion and enrichment path that takes reports from tens of thousands of endpoints, extracts and deduplicates software, and runs an AI research pipeline that classifies and risk-scores every tool. You'll design the data model, the public API our dashboard and customers depend on, and the auth and identity layer that ties it all to real organizations.
What you'll work on
- The event-driven ingestion pipeline: S3 uploads → Lambda processors → Postgres, with idempotent processing, stale-work reaping, and back-pressure at scale.
- The AI enrichment and researcher system — orchestrating LLM-backed agents, handling contradictions, and keeping cost and latency in check.
- The public REST API (Hono), its typed schemas, and the generated clients that consume it.
- Authentication, SSO/SAML federation, and multi-tenant identity and authorization.
- Data modeling and schema evolution you can ship without downtime.
Tech you'll work with
TypeScript on Node 24 · Hono · AWS Lambda, API Gateway, EventBridge, SQS, S3, Cognito · Aurora Serverless v2 Postgres with Drizzle ORM · RDS Proxy · Pulumi (IaC) · pnpm monorepo · GitHub Actions · zod · pino · OpenAPI-generated clients · Sentry · an MCP server exposing the API to agents.
What we're looking for
- 6+ years building and operating production backend systems, ideally distributed or event-driven on a major cloud (AWS a strong plus).
- Deep SQL and relational data modeling — you think in terms of indexes, transactions, and safe schema migrations, and you've been burned by a bad one and learned from it.
- Strong API design instincts and a bias for typed, contract-first interfaces.
- Comfortable owning reliability and observability for the services you build.
- Fluent — or eager to become fluent — with agentic coding tools as a force multiplier.
Nice to have
- Serverless at scale, or cost/latency tuning of LLM pipelines.
- Security, compliance, or B2B SaaS domain experience.
- Familiarity with IaC (Pulumi/Terraform) and a little Rust (our endpoint sensor is Rust).