Member of the Technical Staff, Security Engineer

Tolmo • San Francisco, CA

17h • Onsite

About The Position

Tolmo is building AI security agents that reason over a live graph of production systems and continuously test a faithful copy of those systems. As a Research Engineer on Offensive Security, you will help the agents attack systems like expert human red teamers by researching real-world attack techniques and converting them into production capabilities, tools, and evaluations. The role bridges research and engineering, with work ranging from reproducing new exploit classes and teaching agents to chain vulnerabilities, to building evaluation harnesses and reviewing customer findings. You will work directly with the founders, engineers, and security leads, and your work will ship to production.

The role is based in San Francisco and is performed in person. Tolmo offers competitive salary depending on level and experience, early-stage equity, comprehensive medical, dental, and vision coverage, and necessary work equipment. The company welcomes applicants from all backgrounds and paths into security, including those who may not meet every listed qualification.

Requirements

• Deep hands-on offensive security experience in penetration testing, red teaming, exploit development, or vulnerability research.
• A track record demonstrated through CVEs, bug bounty results, CTF wins, published research, or talks.
• Strong engineering skills and ability to write production-quality code in Go, TypeScript, or Python and build tools others rely on.
• Solid understanding of modern application and cloud architectures and their failure modes, including authentication, access control, SSRF, injection, misconfigured IAM, exposed secrets, and supply chain issues.
• Daily use of AI coding agents such as Claude Code or Cursor, and curiosity about autonomous agents' potential for offensive security work.
• Sound judgment about safety and scope, including testing production-like systems without causing harm.

Nice To Haves

• Certifications such as OSCP, OSEP, OSWE, or CRTO; none are required.
• Experience building or evaluating LLM agents, or applying machine learning to security problems.
• Cloud security depth, including privilege escalation in AWS, GCP, or Azure, Kubernetes, and container escapes.
• Experience on an internal red team or at a security consultancy.
• Contributions to open-source offensive tooling.

Responsibilities

• Research offensive techniques across web applications, APIs, cloud platforms (AWS, GCP, Azure), CI/CD, and identity, and turn them into capabilities for the agents.
• Discover attack paths by determining how individually minor weaknesses can chain into real impact, and encode that reasoning over the graph of code, cloud, and telemetry.
• Build scanners, probes, sandboxes, and exploitation helpers for the agents.
• Design evaluation environments and benchmarks, including intentionally vulnerable targets, to measure whether agents find, exploit, and validate vulnerabilities while minimizing false positives.
• Review agent findings from customer engagements and convert missed findings into test cases and product improvements.
• Track new CVEs, exploitation research, and attacker tradecraft and incorporate them into the product.
• Work with founders, engineers, and security leads to deliver offensive security research and engineering into production.

Benefits

• Early-stage equity; employees will own a real piece of what the company builds.
• Comprehensive medical coverage.
• Dental coverage.
• Vision coverage.
• Equipment needed to do the work.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed