What You'll Do
- Build and optimize our event ingestion pipeline handling millions of events from distributed sensors.
- Design detection rules and correlation logic that identify exploitation patterns across event streams.
- Develop ClickHouse schemas and queries optimized for security event analysis and threat hunting.
- Implement gRPC services for sensor communication and internal microservices.
- Work on Kafka-style message processing for reliable event delivery and processing.
- Build APIs and tooling for security analysts to query and investigate runtime detections.
- Optimize system performance and resource utilization as data volumes scale.
What We're Looking For
- 5+ years of backend development experience building distributed systems.
- Strong Go proficiency, you've shipped production Go services at scale.
- Experience with high-throughput message systems (Kafka, Redpanda, NATS, Pulsar).
- ClickHouse or similar columnar database experience (Druid, TimescaleDB, BigQuery).
- Deep understanding of gRPC, protocol buffers, and service-to-service communication.
- Track record of optimizing performance in data-intensive applications.
- Comfort working with security concepts and detection logic.
- Experience using AI coding assistants and LLM-based tooling in production development workflows.
Nice to Have
- Background in security tooling, SIEM, EDR, or threat detection platforms.
- Experience with stream processing frameworks (Flink, Kafka Streams).
- Kubernetes and containerized microservices deployment.
- Observability stack experience (Prometheus, Grafana).
- Understanding of security detection engineering and MITRE ATT&CK framework.
- Familiarity with prompt engineering, RAG pipelines, or embedded-based search for security applications.
- Open source contributions to Go, Kafka, or ClickHouse ecosystems.
Our Stack
- Go for all backend services.
- gRPC for transport and service communication.
- Redpanda (Kafka-compatible) for event streaming.
- ClickHouse for event storage and analytical queries.
- Kubernetes for deployment.
- Microservices architecture with containerized workloads.
How We Work
We're a small, high-output team that ships fast and iterates faster. No heavy process, no endless meetings, no tickets-for-the-sake-of-tickets. You'll own problems end-to-end, from design through production, with the autonomy to make, and own, real decisions
- AI-first development. AI coding tools aren't optional here, they're how we move at startup speed with a startup-sized team. We use Codex, Claude Code, and LLM-assisted workflows daily for writing, reviewing, debugging, and testing code. If you're not already using AI to multiply your output, you’re already behind.
- High bar, high trust. We hire people who don't need to be managed. You'll be expected to context-switch, dig into unfamiliar systems, and figure things out without a playbook. We review each other's work rigorously but skip the ceremony.
- Startup pace. This is an early-stage cybersecurity company going after a hard problem. The work is demanding, the scope is broad, and the impact is immediate. Every engineer touches the product in ways that are visible to customers.