SH Software Engineer

About this role

SH Software Engineer

COMPENSATION

—

EMPLOYMENT

Full Time

LOCATION

New York, United States

Member of Technical Staff – Software Engineering

AI-native cybersecurity startup

Location: New York

Type: Full time Compensation: Competitive, with meaningful equity

About the company

Our client is an early-stage company applying AI to digital forensics and incident response. Its platform has already supported incident responders through hundreds of real cyber attacks. Drawing on that experience, the team also builds realistic investigation environments and evaluations used to train and benchmark AI on genuine defensive security work, both for its own agents and for partner models.

The mission is to accelerate AI-driven cyber defence in preparation for the security challenges of increasingly capable AI. The company believes deep, automated security investigations will become commonplace as intelligence becomes abundant.

The role

The company runs a live, multi-tenant platform that gathers evidence from customer environments, converts it into a forensic data model, and serves it to both human analysts and AI agents working on the same case.

You’ll own and scale that platform, end to end from data collection to the user interface. The standard is forensic: evidence must be complete, traceable and strictly separated between customers, because findings are relied on by lawyers, insurers and regulators. Example challenges include:

• Scaling evidence collection across Microsoft 365, Google Workspace and Windows, macOS and Linux endpoints, reliably pulling audit logs, mailboxes and host artefacts while respecting API limits
• Developing the evidence pipeline that normalises raw data into a common model of events and entities and produces investigation-ready tables on Apache Iceberg
• Making very large datasets fast to work with, serving tens of millions of events per case from ClickHouse with interactive filtering, search and bulk classification
• Strengthening the multi-tenant foundations: isolation, authorisation, auditability and least-privilege infrastructure for a product that holds sensitive breach data

What you’ll do

• Design, build and run backend services and data pipelines end to end, from API to infrastructure-as-code
• Own pipeline correctness, including idempotent stages, retries and full provenance from every finding back to raw evidence
• Build analyst-facing features alongside the incident response team, such as investigation views, timelines, findings and reports
• Own reliability, performance and observability as volumes grow, including meaningful alerting, runbooks and capacity planning
• Shape key architectural decisions and raise engineering standards across testing, CI/CD and a codebase that both humans and AI agents can work in safely

What we’re looking for

• A track record of building and running production software that real users rely on
• Strong backend Python, including API design, async code, SQL and schema migrations (FastAPI, PostgreSQL, SQLAlchemy, Alembic)
• Experience with data-heavy systems, large volumes of semi-structured logs, columnar formats and pipeline design
• Hands-on production cloud experience with AWS, Terraform, containers and serverless or event-driven orchestration
• Comfort with a modern TypeScript front end (React, Next.js, Tailwind), or happy to work closely with those who are
• AI coding agents as a core part of how you work, with care for keeping code readable to them
• A habit of working closely with users and iterating quickly
• Genuine motivation for the mission

Candidates are encouraged to apply even if they don’t tick every box.

Nice to have

• Lakehouse or analytical database experience (Iceberg, ClickHouse, DuckDB, Polars or similar)
• Experience with Microsoft Graph API, Google Workspace Admin SDK or endpoint forensics tools
• Multi-tenant SaaS experience with tenant isolation and RBAC, or work in SOC 2 or other regulated settings
• A background in cybersecurity, incident response or digital forensics
• SRE experience, including on-call, incident response and SLO design
• Open-source contributions or a history of shipping side projects

APPLICATION

Apply for this position

Complete the form and upload your CV. PDF or DOCX, maximum 10 MB.