Member of the Technical Staff, Security Engineer
About The Position
Tolmo is building cybersecurity products for the age of AI. Its platform uses AI security agents to reason over a live graph of production systems—including code, CI, cloud, and telemetry—and continuously test a faithful copy for vulnerabilities. Findings are validated and include blast-radius information and remediation plans. In this offensive security research and engineering role, you will help Tolmo’s agents attack systems like skilled human red teamers. You will research real-world attack techniques, develop tools and evaluations for the agents, and validate their performance in customer environments. The work spans research and production engineering, and you will collaborate directly with the founders, engineers, and security leads.
Requirements
- Deep hands-on offensive security experience in penetration testing, red teaming, exploit development, or vulnerability research.
- A demonstrated track record, such as CVEs, bug bounty results, CTF wins, published research, or talks.
- Strong engineering skills and the ability to write production-quality code in Go, TypeScript, or Python and build tools others rely on.
- Solid understanding of modern application and cloud architectures and their failure modes, including authentication, access control, SSRF, injection, misconfigured IAM, exposed secrets, and supply chain risks.
- Daily use of AI coding agents, such as Claude Code or Cursor, and curiosity about autonomous agents’ potential in offensive security.
- Sound judgment about safety and scope, including how to test production-like systems without causing harm.
Nice To Haves
- Certifications such as OSCP, OSEP, OSWE, or CRTO; none are required.
- Experience building or evaluating LLM agents, or applying machine learning to security problems.
- Cloud security depth, including privilege escalation in AWS, GCP, or Azure, Kubernetes, and container escapes.
- Experience on an internal red team or at a security consultancy.
- Contributions to open-source offensive tooling.
Responsibilities
- Research offensive techniques across web applications, APIs, cloud platforms (AWS, GCP, and Azure), CI/CD, and identity, and turn them into agent capabilities.
- Identify attack paths by determining how weaknesses can be chained into meaningful impact, and encode that reasoning over Tolmo’s graph of code, cloud, and telemetry.
- Build scanners, probes, sandboxes, and exploitation helpers for the agents.
- Design evaluation environments, including intentionally vulnerable targets, to measure whether agents can find, exploit, and validate vulnerabilities while limiting false positives.
- Review agent findings from customer engagements and turn misses into test cases and product improvements.
- Track new CVEs, exploitation research, and attacker tradecraft, and incorporate relevant techniques into the product.
Benefits
- Competitive salary, depending on level and experience.
- Early-stage equity.
- Comprehensive medical, dental, and vision coverage.
- Equipment needed to do your best work.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Education Level
No Education Listed
