Senior Software Engineer (AI Cyber Security Startup)

Job Description

Member of Technical Staff: Software Engineering

\n

\n

New York City · Hybrid (2–3 days a week in office) · Full time

\n

\n

Own and scale the production platform behind an AI-native digital forensics and incident response (DFIR) startup, from our New York office.

\n

\n

About the company

\n

\n

We’re a venture-backed, seed-stage company building AI-native Digital Forensics and Incident Response. Our platform has already helped incident responders handle hundreds of cyberattacks.

\n

\n

Building on that, we create realistic investigation environments and evaluations to train and measure AI on real defensive work, for our own agents and for our partners’ models.

\n

\n

Our mission is to accelerate AI cyberdefense to meet the security challenges of the AGI era. We believe automated digital forensics, meaning deep security investigations, will become ubiquitous in a world with abundant intelligence.

\n

\n

About the role

\n

\n

We run a production, multi-tenant platform that collects evidence from customer environments, processes it into a forensic data model, and serves it to human analysts and AI agents working the same case. It is live and handling real incidents today.

\n

\n

We’re hiring engineers in New York to own and scale that platform. The work runs from evidence collection to the pixels on screen. The bar is forensic: evidence must be complete, traceable and isolated between tenants, because findings end up in front of lawyers, insurers and regulators.

\n

\n

What you’ll work on

\n

\n

\n
• Evidence collection. Scale our collectors across Microsoft 365, Google Workspace and endpoints (Windows, macOS, Linux), pulling audit logs, mailboxes and host artefacts from customer tenants reliably and within their API limits.
\n
• The evidence pipeline. Evolve the pipeline that normalises raw evidence into a common model of events and entities, and materialises investigation-ready tables on Apache Iceberg.
\n
• Investigation-scale exploration. Serve tens of millions of events per case from ClickHouse with interactive filtering, search and bulk classification.
\n
• The multi-tenant foundation. Harden tenant isolation, authorisation, auditability and least-privilege infrastructure for a security product that holds other people’s breach data.
\n

\n

\n

Responsibilities

\n

\n

\n
• Design, ship and operate backend services and data pipelines end to end, from the API to the Terraform.
\n
• Own pipeline correctness: idempotent stages, leases and retries, and provenance from every finding back to the raw evidence.
\n
• Build the analyst-facing product alongside our incident responders: investigation views, timelines, findings and reports.
\n
• Own reliability, performance and observability as volume grows: alarms that mean something, runbooks and capacity planning.
\n
• Make key architectural decisions and raise the engineering bar: testing, CI/CD, and a codebase that agents and humans can both work in safely.
\n

\n

\n

You may be a fit if you

\n

\n

\n
• Have built, shipped and operated production software that real users depend on.
\n
• Write strong backend Python: API design, async code, SQL and schema migrations (we use FastAPI, PostgreSQL, SQLAlchemy and Alembic).
\n
• Are comfortable with data-intensive systems: large volumes of semi-structured logs, columnar formats, and how data moves through a pipeline.
\n
• Have run cloud infrastructure in production: AWS, Terraform, containers, and serverless or event-driven orchestration.
\n
• Are comfortable with a modern TypeScript front end (React, Next.js, Tailwind), or happy to work closely with engineers who are.
\n
• Use AI coding agents as a core part of how you build, and care about keeping a codebase legible to them.
\n
• Work closely with users and iterate quickly to deliver working software.
\n
• Are deeply motivated by our mission.
\n

\n

\n

You’re encouraged to apply even if you don’t meet every listed qualification.

\n

\n

Nice to have

\n

\n

\n
• Lakehouse or analytical-database experience: Apache Iceberg, ClickHouse, DuckDB, Polars or similar.
\n
• Experience with the Microsoft Graph API, the Google Workspace Admin SDK, or endpoint forensics tooling such as Velociraptor.
\n
• Multi-tenant SaaS with tenant isolation and RBAC, or work in SOC 2 or other regulated environments.
\n
• A background in cybersecurity, incident response or digital forensics.
\n
• Site reliability experience: on-call, incident response and SLO design.
\n
• Open-source contributions or a track record of shipping side projects.
\n

\n

\n

Compensation and working model

\n

\n

$220,000 – $260,000 base salary plus meaningful equity, depending on experience and level.

\n

\n

This is a hybrid role based in New York City. You’ll spend 2–3 days a week in our NYC office, working in person with engineers and incident responders, with the rest of the week remote.

\n