Member of the Technical Staff, Software Engineering

Tolmo•San Francisco, CA

9h•Onsite

About The Position

Tolmo is building cybersecurity products for the age of AI. Its platform uses AI security agents to reason over a live graph of a customer’s production system—including code, CI, cloud, and telemetry—and continuously test a faithful copy for vulnerabilities. Findings are validated and include their blast radius and a remediation plan. As a Member of the Technical Staff, Software Engineering, you will build the security graph, the infrastructure that runs the agents, and the agents themselves. The role spans a variety of technical areas, with no fixed lanes. You will own problems end to end, from working with customers and designing solutions through shipping and monitoring them in production. You will work directly with Tolmo’s founders and engineering team, which ships to production daily and uses coding agents extensively.

Requirements

Strong software engineering fundamentals and a track record of shipping and owning production systems end to end.
Fluency in at least one of Go or TypeScript, and willingness to work across the stack.
Experience with distributed systems, data pipelines, or cloud infrastructure such as AWS, GCP, or Azure.
Daily use of AI coding agents, such as Claude Code or Cursor, and informed opinions on how to make them reliable.
Curiosity about how real systems break and interest in understanding attacks, not just alerts.
Ability to own ambiguity and an interest in defining how something works rather than only executing an established process.

Nice To Haves

Offensive security experience, such as penetration testing, red teaming, bug bounty, or CTFs.
Experience building LLM agents, evaluations, or agent tooling in production.
Experience with graph data models or graph databases such as Neptune, Neo4j, or Memgraph.
Background in application or cloud security tooling such as SAST, DAST, CSPM, or SIEM.
Prior early-stage startup or founding-engineer experience.

Responsibilities

Build and extend the live security graph, including crawlers that discover cloud, SaaS, and code resources and pipelines that model a customer’s production system.
Design, evaluate, and improve AI security agents that pentest, triage, chain, and remediate findings; build evaluations to measure their effectiveness.
Own services end to end across Go, TypeScript, PostgreSQL, graph databases, and AWS, from design through deployment and on-call.
Make the platform safe to use against production systems through tenant isolation, egress controls, and secrets handling.
Work with customers and security leads to turn real findings, misses, and false positives into product improvements.
Help set engineering standards as the company grows, including code quality, review culture, tooling, and practices for building with AI agents.