ABOUT TOLMO
Tolmo is cybersecurity for the age of AI. Coding agents now ship software faster than any human team can review or secure it; 100+ pull requests per engineer per week is no longer an outlier, and attackers are using the same agents to find and exploit weaknesses in days, not months. The old playbook of quarterly pentests and endless alert queues breaks at this speed.
We're building a new security playbook. Tolmo runs a fleet of AI security agents that reason over a live graph of your entire production system (code, CI, cloud, and telemetry) and continuously attack a faithful copy of it like a real adversary. Every finding arrives validated, with its blast radius and a remediation plan that lands in your workflow, ready for a coding agent to fix. Hours to integrate, days to your first validated finding.
We've done this before: Tolmo's founders built Sqreen (acquired by Datadog) and led security products that thousands of organizations trusted. We're backed by Accel and Y Combinator and just getting started.
THE ROLE
As a Member of the Technical Staff, you build the system that makes our agents good at security: the graph they reason over, the infrastructure they run on, and the agents themselves. There are no fixed lanes. In one week you might ship a new cloud integration, rework how the graph links an endpoint to the code that serves it, and tune an offensive agent so it chains two low-severity findings into a real exploit.
You'll work directly with the founders and a small team of engineers who ship to production every day, and who use coding agents as heavily as the customers we protect. You'll own problems end to end: talk to the customer, design the fix, ship it, and watch it run in production.
WHAT YOU'LL DO
- Build and extend the live security graph: crawlers that discover cloud, SaaS, and code resources, and the pipeline that turns them into a consistent model of a customer's production system.
- Design, evaluate, and improve AI security agents that pentest, triage, chain, and remediate findings, and build the evals that tell us whether they actually got better.
- Own services end to end across Go, TypeScript, PostgreSQL, graph databases, and AWS, from design through deployment and on-call.
- Make the platform safe to point at production: strict tenant isolation, egress controls, and secrets handling that customers' security teams will scrutinize.
- Work with customers and our security leads to turn real findings, misses, and false positives into product improvements.
- Set the engineering bar as we grow: code quality, review culture, tooling, and how we build with AI agents.
WHAT WE'RE LOOKING FOR
- Strong software engineering fundamentals and a track record of shipping and owning production systems end to end.
- Fluency in at least one of Go or TypeScript, and the willingness to work across the stack.
- Experience with distributed systems, data pipelines, or cloud infrastructure (AWS, GCP, or Azure).
- You build with AI coding agents daily (e.g., Claude Code, Cursor) and have opinions about how to make them reliable.
- Curiosity about how real systems break: you want to understand the attack, not just the alert.
- You own ambiguity: energized by defining how something works, not just executing a process.
NICE TO HAVE
- Offensive security experience: penetration testing, red teaming, bug bounty, or CTFs.
- Experience building LLM agents, evals, or agent tooling in production.
- Experience with graph data models or graph databases (Neptune, Neo4j, Memgraph).
- Background in application or cloud security tooling (SAST, DAST, CSPM, SIEM).
- Prior early-stage startup or founding-engineer experience.
COMPENSATION & BENEFITS
- Base salary: [PAY RANGE], depending on level and experience.
- Early-stage equity: you're joining early; you'll own a real piece of what we build.
- Comprehensive medical, dental, and vision coverage, and the equipment you need to do your best work.
- Based in San Francisco; we work in person.
Tolmo is building a team with wide-ranging backgrounds, perspectives, and paths into security; we think it makes our product and judgment better. If you're excited about this role but don't match every point above, we'd still like to hear from you. We're an equal opportunity employer and welcome applicants of every background.