Member of the Technical Staff, Security Engineer

Tolmo; San Francisco (CA); On-site; USD 150,000 - 210,000; Full time

Benefits offered by this job

Competitive salary

Early-stage equity

Comprehensive medical, dental, and视on

In-person at San Francisco office

Job summary

Tolmo in San Francisco is hiring a Research Engineer on Offensive Security to push our agents to attack like top red teams and then improve. You’ll research how real systems break, translate that knowledge into techniques, tooling, and evaluations, and validate them in real customer environments.

Reporting between research and engineering, you’ll reproduce exploit classes, chain vulnerabilities, and build harnesses and tests.

Qualifications

• Deep hands-on offensive security experience: penetration testing, red teaming, exploit development, or vulnerability research.
• A track record that shows it: CVEs, bug bounty results, CTF wins, published research, or talks.
• Strong engineering skills: production-quality code in Go, TypeScript, or Python and building reusable tools.
• Understanding of modern apps and cloud architectures and how they fail: auth, IAM, SSRF, injections.

Responsibilities

• Exploit research across web apps, APIs, cloud, CI/CD, and identity to enable field-use capabilities.
• Attack-path discovery: reason about how minor weaknesses chain into real impact.
• Red-team tooling: build scanners, probes, sandboxes, and exploitation helpers.
• Evals and benchmarks: design environments to measure agent success and minimize false positives.
• Field validation: review agent findings from customer engagements and improve test cases.
• Staying ahead: track CVEs and attacker tradecraft and push into the product.

Job description

About Tolmo

Tolmo is cybersecurity for the age of AI. Coding agents now ship software faster than any human team can review or secure it; 100+ pull requests per engineer per week is no longer an outlier, and attackers are using the same agents to find and exploit weaknesses in days, not months. The old playbook of quarterly pentests and endless alert queues breaks at this speed.

We're building a new security playbook. Tolmo runs a fleet of AI security agents that reason over a live graph of your entire production system (code, CI, cloud, and telemetry) and continuously attack a faithful copy of it like a real adversary. Every finding arrives validated, with its blast radius and a remediation plan that lands in your workflow, ready for a coding agent to fix. Hours to integrate, days to your first validated finding.

We've done this before: Tolmo's founders built Sqreen (acquired by Datadog) and led security products that thousands of organizations trusted. We're backed by Accel and Y Combinator and just getting started.

The role

As a Research Engineer on Offensive Security, you make our agents attack like the best human red teamers, and then better. You'll research how real systems get broken, turn that knowledge into techniques, tools, and evaluations our agents can use, and prove it against real customer environments.

This sits between research and engineering. In one week you might reproduce a new exploit class, teach an agent to chain an SSRF into cloud credential access, build the harness that checks whether it actually got there, and review the findings it files for a customer. You'll work directly with the founders, our engineers, and the security leads who run pentests with our agents, and your work ships to production.

What you'll do

• Exploit research: study techniques across web applications, APIs, cloud (AWS, GCP, Azure), CI/CD, and identity, and turn them into capabilities our agents use in the field.

• Attack-path discovery: work out how individually minor weaknesses chain into real impact, and encode that reasoning over our live graph of code, cloud, and telemetry.

• Red-team tooling: build the scanners, probes, sandboxes, and exploitation helpers our agents call while they work.

• Evals and benchmarks: design environments, including intentionally vulnerable targets, that measure whether our agents find, exploit, and validate real vulnerabilities, and keep false positives out.

• Field validation: review agent findings from customer engagements, and turn every miss into a test case and an improvement.

• Staying ahead: track new CVEs, exploitation research, and attacker tradecraft, and get them into the product within days.

What we're looking for

• Deep hands-on offensive security experience: penetration testing, red teaming, exploit development, or vulnerability research.

• A track record that shows it: CVEs, bug bounty results, CTF wins, published research, or talks.

• Strong engineering skills: you write production-quality code (Go, TypeScript, or Python) and build tools other people rely on, not just one-off scripts.

• Solid understanding of modern application and cloud architectures and how they fail: auth, access control, SSRF, injection, misconfigured IAM, exposed secrets, supply chain.

• You build with AI coding agents daily (e.g., Claude Code, Cursor) and are curious about how far autonomous agents can take offensive work.

• Sound judgment about safety and scope: you know how to test production-like systems without causing harm.

Nice to have

• Certifications like OSCP, OSEP, OSWE, or CRTO. None are required.

• Experience building or evaluating LLM agents, or applying machine learning to security problems.

• Cloud security depth: privilege escalation in AWS, GCP, or Azure, Kubernetes, and container escapes.

• Experience on an internal red team or at a security consultancy.

• Contributions to open-source offensive tooling.

Compensation & benefits

• Competitive salary, depending on level and experience.

• Early-stage equity: you're joining early; you'll own a real piece of what we build.

• Comprehensive medical, dental, and vision coverage, and the equipment you need to do your best work.

• Based in San Francisco; we work in person.

Tolmo is building a team with wide-ranging backgrounds, perspectives, and paths into security; we think it makes our product and judgment better. If you're excited about this role but don't match every point above, we'd still like to hear from you. We're an equal opportunity employer and welcome applicants of every background.