Senior Software Engineer, Investigations & Cases
About The Position
Todyl is seeking a Senior Software Engineer to build and operate the systems used by its security operations center (SOC) analysts and partners. The role owns services across investigations, cases, and the automation connecting them, including the analyst investigation surface, alert-to-case lifecycle, response automation, and partner-tool integrations. The engineer works directly with SOC users to understand their workflows and improve the systems they use. This is a hands-on engineering role focused primarily on designing and building services, shipping changes, and handling operational ownership, including participation in the on-call rotation. Detection Engineering owns detection content, while the Detection & Response Operations lead sets analyst practice. The position reports to the Senior Manager, Security Platform Engineering and may be based in the Atlanta or Denver offices or remotely within the US.
Requirements
- At least 8 years of experience building and operating production software, including at least 4 years writing backend services in Go.
- Experience carrying production on-call for systems the candidate designed.
- Demonstrated experience designing, building, and operating services in distributed, event-driven architectures, including data models, APIs, asynchronous processing, and behavior under load.
- Hands-on experience with systems involving complex state, such as entity lifecycles, ownership transfers, concurrent users, idempotency under at-least-once delivery, and defensible audit trails.
- Production experience with an event streaming platform such as Redpanda or Kafka, and a columnar analytical store such as ClickHouse or equivalents.
- Experience building and owning an application used by professional operators as their primary working surface, and shipping changes that measurably reduce task time.
- Experience building and maintaining integrations with third-party APIs, including handling retries, rate limits, partial failures, and schema drift.
- Working knowledge of detection and response, including how detections become alerts and how analysts triage and investigate them.
- Prior work at a security vendor, MDR, MSSP, or an in-house SOC tooling team.
- Familiarity with MSP/MSSP or multi-tenant environments.
- Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience.
- Extreme ownership, especially when problems arise or work is delayed.
- Self-motivation, an intrinsic drive to learn and grow, and a focus on raising the bar for oneself and the team.
- A strong bias for action and impact, including making timely decisions, measuring results, and iterating.
Nice To Haves
- Familiarity with SOAR or workflow-automation platforms such as Torq, Tines, XSOAR, Swimlane, or a homegrown equivalent.
- Familiarity with PSA and RMM tooling in the MSP channel.
- Contributions to open security or detection tooling.
Responsibilities
- Build and evolve analyst tools for triaging and investigating alerts, pivoting across telemetry, gathering evidence, and recording findings; work with analysts to understand workflow problems.
- Build and own services for the alert-to-case lifecycle, including state, ownership, shift and site handoffs, resolution, and audit trails.
- Develop response actions and playbook capabilities on the SOAR and workflow layer, including approval gates and checks for AI-assisted output before it reaches partners.
- Build partner-tool integrations and improve the underlying integration framework.
- Instrument services and own latency, throughput, and failure modes at multi-tenant scale; participate in the on-call rotation.
- Write design documents and bring work to review early.
- Conduct code reviews, pair with colleagues, and mentor less experienced engineers.
Benefits
- Employee equity program.
- Medical, dental, and vision insurance options.
- Unlimited paid time off.
- 401(k) plan.
- Paid parental leave.
- Hybrid work environment with offices in Denver, Midtown Atlanta, and Augusta, Georgia.
- Parking and public transportation commuter benefits.
- Professional growth and development opportunities.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
