Impress employers and recruiters.
Choose from hundreds of resume examples.
Impress employers and recruiters.
Choose from hundreds of resume examples.
Tailor your resume to this Member of the Technical Staff, Security Engineer role.
Rezi rewrites your resume against Tolmo's job description. Free.
Tailor your resume to this Member of the Technical Staff, Security Engineer role.
Rezi rewrites your resume against Tolmo's job description. Free.
Don't guess if your resume is good enough.
See how it scores against the Member of the Technical Staff, Security Engineer posting at Tolmo — free, in seconds.
Don't guess if your resume is good enough.
See how it scores against the Member of the Technical Staff, Security Engineer posting at Tolmo — free, in seconds.
About the Role
As a Research Engineer on Offensive Security, you will enhance our agents' attack capabilities by researching system vulnerabilities, developing new techniques and tools, and validating them in customer environments. This role bridges research and engineering, involving exploit reproduction, agent training, tool development, and direct collaboration with founders and security leads.
Responsibilities
- Research exploit techniques across web applications, APIs, cloud, CI/CD, and identity, and translate them into agent capabilities.
- Determine how minor weaknesses chain into significant impact and encode this reasoning within the live system graph.
- Develop scanners, probes, sandboxes, and exploitation helpers for agent use.
- Design evaluation environments and benchmarks to measure agent performance in finding, exploiting, and validating vulnerabilities.
- Review agent findings from customer engagements, converting misses into test cases and improvements.
- Track new CVEs, exploitation research, and attacker tradecraft, integrating them into the product rapidly.
Requirements
- Deep hands-on offensive security experience: penetration testing, red teaming, exploit development, or vulnerability research.
- A proven track record demonstrated through CVEs, bug bounty results, CTF wins, published research, or talks.
- Strong engineering skills with the ability to write production-quality code (Go, TypeScript, or Python) and build reliable tools.
- Solid understanding of modern application and cloud architectures and their failure modes (e.g., auth, access control, SSRF, injection, misconfigured IAM, exposed secrets, supply chain).
- Daily use of AI coding agents (e.g., Claude Code, Cursor) and curiosity about autonomous agents in offensive work.
- Sound judgment regarding safety and scope when testing production-like systems.
Skills
- Offensive security
- Penetration testing
- Red teaming
- Exploit development
- Vulnerability research
- Go
- TypeScript
- Python
- Web application security
- API security
- Cloud security (AWS, GCP, Azure)
- CI/CD security
- Identity management security
- AI coding agents
Location
- San Francisco
Work Type
- Onsite
- Full-time
Experience Level
- Competitive salary, depending on level and experience
Education Level
- Certifications like OSCP, OSEP, OSWE, or CRTO are nice to have but not required.
Benefits
- Competitive salary
- Early-stage equity
- Comprehensive medical, dental, and vision coverage
- Equipment needed for work
About the Company
- Tolmo provides cybersecurity solutions for the AI era, developing AI security agents that continuously attack a faithful copy of a company's production system to identify and validate vulnerabilities.
- The company's founders previously built Sqreen, which was acquired by Datadog.
- Tolmo is backed by Accel and Y Combinator.
Equal Opportunity
- Tolmo is building a team with wide-ranging backgrounds, perspectives, and paths into security; we think it makes our product and judgment better.
- We are an equal opportunity employer and welcome applicants of every background.