Senior Software Engineer, Investigations & Cases

Todyl; United States; Remote; USD 160,000 - 190,000; Full time

Benefits offered by this job

Equity Ownership

Health & Wellness

Unlimited PTO

401(k) plan

Paid Parental Leave

Hybrid Work Environment

Commuter Benefits

Professional Growth & Development

Job summary

Todyl in the United States is seeking a Senior Software Engineer to build the systems analysts rely on—the investigation surface, the case that carries a finding to the partner, and the automation moving work between them. A detection firing is the start of the job. Everything after it happens in your systems.

This is a hands-on build role, reporting to the Senior Manager, Security Platform Engineering. You will design and ship backend services in Go, own operability and multi-tenant

Qualifications

• 8+ years building and operating production software.
• 4+ years writing backend services in Go.
• Experience designing, building, and operating distributed, event-driven services.
• Hands-on with stateful systems including audit trails and ownership transfer.
• Production experience with event streaming and analytical data stores (Redpanda, Kafka, ClickHouse).
• Familiarity with SOAR or workflow-automation platforms and MSP/MSSP environments.
• Bachelor’s degree in Computer Science, Cybersecurity, or related field, or equivalent practical experience.

Responsibilities

• Build and evolve the Investigation Surface tooling for analysts.
• Own the Alert-to-Case lifecycle from signal to resolution with audit trails.
• Develop Response Automation and playbooks within SOAR/workflow layers.
• Create partner-tool integrations and improve underlying framework.
• Ensure operability: latency, throughput, and multi-tenant reliability; participate in on-call rotations.
• Contribute to design docs, reviews, and mentor junior engineers.

Skills

Go backend

Distributed systems

On-call production

Event streaming

System design

SOAR integrations

MSP/MSSP familiarity

Security tooling

Education

Bachelor's degree or equivalent

Tools

Redpanda

Kafka

ClickHouse

Torq

Tines

XSOAR

Swimlane

PSA tooling

RMM tooling

Job description

About the Role

We are looking for a Senior Software Engineer to build the systems our analysts and partners live in — the investigation surface where our SOC works alerts, the case that carries a finding to the partner, and the automation that moves work between them. A detection firing is the start of the job. Everything after it happens in your systems.

This is a hands-on build role. Most of your week is building — designing services, shipping them, and carrying the operational half, on-call included. You will not be writing detection content, which Detection Engineering owns, or setting analyst practice, which our Detection & Response Operations lead owns. They decide how alerts get worked. You own the system they get worked in.

This role reports to the Senior Manager, Security Platform Engineering, and can be based in our Atlanta or Denver offices or remotely within the US. You will own services across Investigations, Cases, and the automation between them, and you will work directly with our SOC — they are the people using what you build, on every shift, and the fastest way to know whether a change landed is to ask them.

Key Responsibilities

• Investigation Surface: Build and evolve the tooling our analysts use to triage and investigate — pivoting across telemetry, gathering evidence, and recording what they found. Spend enough time with analysts to know where the workflow actually hurts.
• Alert-to-Case Lifecycle: Build and own services along the path from signal to case to resolution — state, ownership, handoff across shifts and sites, and the audit trail. Make the case surface something a partner reads and immediately understands.
• Response Automation: Build response actions and playbook capabilities on our SOAR and workflow layer, including the approval gates that keep a person in the loop where one belongs, and the checks that catch AI-assisted output before a partner sees it.
• Integrations: Build partner-tool integrations and sharpen the framework underneath them as you go, so the next integration is cheaper than the last rather than another entry on a pile.
• Operability: Instrument what you build so failures surface before partners feel them. Own latency, throughput, and the failure modes that only appear at multi-tenant scale, and join the on-call rotation for your services.
• Craft & Review: Write the design docs for your own work and bring them to review early. Raise the bar around you through code review and pairing, and mentor engineers earlier in their careers.

Values Fit

• Extreme ownership, particularly when things go wrong or aren’t completed on time.
• Intrinsic drive for growth; self-motivated, always learning, and focused on raising the bar for self and team.
• Strong bias for action with impact; make tough decisions quickly, measure results, and iterate with clarity to move the mission forward.

Who You Are

• Experience: 8+ years building and operating production software, including 4+ years writing backend services in Go. You have carried production on-call for systems you designed.
• Distributed Services: Demonstrated experience designing, building, and operating services in a distributed, event-driven architecture — data model, API, asynchronous processing, and behavior under load. You have drawn service boundaries and lived with the consequences.
• State & Correctness: Hands-on with systems where the hard problem is state rather than throughput — entity lifecycles, ownership transfer, concurrency between users, idempotency under at-least-once delivery, and audit trails that stay defensible months later.
• Streaming & Analytical Data: Production experience with an event streaming platform (Redpanda, Kafka, or equivalent) and a columnar analytical store (ClickHouse or equivalent). You can explain the access patterns each is suited to and design accordingly.
• Operator-Facing Systems: You have built and owned an application that professional operators use as their primary working surface. You can tell a feature request from a workflow problem, and you have shipped changes that measurably cut the time a task takes.
• Integrations & Automation: Experience building and maintaining integrations against third-party APIs you do not control — retry strategy, rate limiting, partial failure, and schema drift. Familiarity with SOAR or workflow-automation platforms (Torq, Tines, XSOAR, Swimlane, or a homegrown equivalent) and with PSA and RMM tooling in the MSP channel is a strong plus.
• Security Operations Domain: Working knowledge of detection and response — how a detection becomes an alert, how an analyst triages and investigates it, and why false positives are expensive. Prior work at a security vendor, MDR, MSSP, or on an in-house SOC tooling team.
• Partner Awareness: Familiarity with MSP/MSSP or multi-tenant environments, where one customer’s volume can affect another.
• Education & Certifications: Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience. Contributions to open security or detection tooling are a plus.

Benefits & Perks

At Todyl, we believe in investing in our people and creating an environment where employees can thrive both personally and professionally. We offer a comprehensive benefits package designed to support well-being, flexibility, and long-term career growth.

Our benefits include:

• Equity Ownership: Opportunity to share in Todyl’s growth and success through our employee equity program. We believe in giving our team a meaningful stake in the company we’re building together.

• Health & Wellness: Comprehensive medical, dental, and vision insurance options to support you and your family.

• Unlimited PTO: Flexible, unlimited paid time off to recharge, prioritize personal well-being, and maintain a healthy work-life balance.

• Retirement Savings: 401(k) plan to help you invest in your financial future.

• Paid Parental Leave: Dedicated paid leave to support employees as they grow their families.

• Hybrid Work Environment: A collaborative hybrid work model with offices in Denver’s LoDo neighborhood, Midtown Atlanta, and Augusta, GA, balancing in-person collaboration with flexibility

• Commuter Benefits: Parking and public transportation benefits to help make your commute easier and more convenient.

• Professional Growth & Development: Opportunities to expand your skills, take on new challenges, and grow your career alongside a rapidly evolving cybersecurity company.

At Todyl, you’ll have the opportunity to make a real impact, take ownership of meaningful work, and share in the success of what we’re building together.

The anticipated base salary range for this position is $160,000-190,000 annually, with final compensation determined based on experience, skills, qualifications, and other job-related factors.