Member of the Technical Staff, Software Engineering

Tolmo•San Francisco, CA

8d•Onsite

About The Position

Tolmo is building cybersecurity products for the age of AI. Its platform uses AI security agents to reason over a live graph of a customer's production system and continuously test a faithful copy for security weaknesses. Findings are validated and supplied with their blast radius and a remediation plan. As a Member of the Technical Staff, Software Engineering, you will build the security graph, the infrastructure that runs the agents, and the agents themselves. The role spans a range of engineering work, including integrations, graph modeling, and offensive agent development. You will work directly with the founders and a small engineering team, own problems from customer conversations and design through deployment, and observe your work in production. You will also help set engineering practices as the company grows.

Requirements

Strong software engineering fundamentals and a track record of shipping and owning production systems end to end.
Fluency in at least one of Go or TypeScript, and willingness to work across the stack.
Experience with distributed systems, data pipelines, or cloud infrastructure such as AWS, GCP, or Azure.
Daily use of AI coding agents, such as Claude Code or Cursor, and opinions on how to make them reliable.
Curiosity about how real systems break and a desire to understand attacks, not just alerts.
Ability to own ambiguity and enthusiasm for defining how something works rather than only executing an established process.

Nice To Haves

Offensive security experience, such as penetration testing, red teaming, bug bounty, or CTFs.
Experience building LLM agents, evaluations, or agent tooling in production.
Experience with graph data models or graph databases such as Neptune, Neo4j, or Memgraph.
Background in application or cloud security tooling such as SAST, DAST, CSPM, or SIEM.
Prior early-stage startup or founding-engineer experience.

Responsibilities

Build and extend the live security graph, including crawlers that discover cloud, SaaS, and code resources and the pipeline that models a customer's production system.
Design, evaluate, and improve AI security agents that pentest, triage, chain, and remediate findings; build evaluations to measure their effectiveness.
Own services end to end across Go, TypeScript, PostgreSQL, graph databases, and AWS, from design through deployment and on-call.
Make the platform safe to use against production systems through strict tenant isolation, egress controls, and secrets handling.
Work with customers and security leads to turn real findings, missed findings, and false positives into product improvements.
Help set engineering standards and practices, including code quality, review culture, tooling, and development with AI agents.