Research Engineer, AI Security
About The Position
Tolmo is building cybersecurity products for the age of AI. Its platform uses AI security agents to reason over a live graph of customers’ production systems—including code, CI, cloud, and telemetry—and continuously test a faithful copy of those systems. Findings are validated and delivered with blast-radius information and remediation plans. As a Research Engineer on AI Security, you will improve the judgment of Tolmo’s agents: how they plan, reason over production-system graphs, select tests, and determine whether findings are real. The role bridges research and engineering. Work may include designing evaluations for false positives, improving multi-step agent investigations, comparing models on benchmarks, and protecting agents from prompt injection. You will work with the founders, engineers, and security leads, and your work will ship to production.
Requirements
- Hands-on experience building, evaluating, or improving LLM-based agents or systems in production.
- A rigorous, empirical approach to experimentation, including skepticism toward single anecdotes and reliance on evaluation results.
- Strong engineering skills and the ability to write production-quality code in Python, TypeScript, or Go and build tools others rely on.
- A working understanding of security or a strong drive to learn it quickly, including how real systems are attacked and how findings are validated.
- Familiarity with LLM security risks such as prompt injection, jailbreaks, and tool misuse.
- Regular use of AI coding agents such as Claude Code or Cursor, with informed opinions about what makes them reliable.
Nice To Haves
- Research background in machine learning, AI safety, or security, demonstrated through publications, open-source work, or talks.
- Offensive security experience such as penetration testing, red teaming, bug bounty, or CTFs.
- Experience with reinforcement learning, fine-tuning, or synthetic data generation for agents.
- Experience with graph data models or reasoning over structured data.
- Prior early-stage startup experience.
Responsibilities
- Improve how agents plan, use tools, and reason over live graphs of code, cloud, and telemetry so they identify valid findings faster and with fewer dead ends.
- Build evaluations, benchmarks, and graders to measure agent performance, and integrate them into the process for shipping changes.
- Compare models, prompts, and agent designs for cost, latency, and quality, and use the results to inform production decisions.
- Protect agents against prompt injection, data exfiltration, and manipulation by the systems they test, and research security risks in customers’ LLM-based applications.
- Improve the reliability of long-running agents across thousands of runs through verification, self-checks, and sensible stopping behavior.
- Analyze agent runs from customer engagements, identify reasoning failures, and turn each failure into an evaluation and a fix.
Benefits
- Competitive salary, depending on level and experience.
- Early-stage equity.
- Comprehensive medical, dental, and vision coverage.
- Equipment needed to do your best work.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Education Level
No Education Listed
