Founding Engineer

• A near-real-time, self-updating map of an environment so you can see an attack as it happens, plus “time travel” in the graph so you can replay it afterward.
• Teaching an agent to answer questions about a large graph quickly, with only the context it needs and without making mistakes.
• Determining who owns a given resource from messy signals like tags, actions, logs, and files.

Stack: Cartography for ingestion, Neo4j for the graph, Python/FastAPI backend, Svelte frontend with a homegrown WebGL graph renderer, an MCP server that exposes all of it to agents, Terraform for IaC.

3+ years at high-growth companies, strong distributed systems and cloud experience, a real sense of ownership, first-principles thinking, and a willingness to implement gnarly business logic (elegantly, ideally) if it makes a jaded security engineer’s life easier. Kubernetes and security knowledge are nice to have, not required. You’re in the Bay Area and want to be in the office five days a week.

Process: technical screen, call with the founders, a paid day working with the team, then offer.

• Health/vision/dental
• 401k match
• gym
• team lunches
• unlimited PTO

Hihi, I’m Alex, co-founder and CEO. Subimage maps infrastructure the way an attacker does so security teams at scale-ups and enterprises can find and fix problems. We’re built on Cartography ( https://cartography.dev ), the open source infra mapping tool we helped create at Lyft and donated to the CNCF. It runs at over 70 companies, including 7 in the Fortune 100. We’re a tiny seed-stage team and our customers are companies your parents have heard of. We have more demand than we can build for, which is why this post exists. This is a chance to get in on the ground floor of something big (or to find out quickly that it won’t work; just being upfront about it).

Some of the problems you’d be working on:

• Vulnerability triage with real context: is the asset internet-facing, through which services, is the vulnerable function actually reachable in code, are there compensating controls, and what sensitive data does it reach once exploited, across how many hops.
• Proving that the security fixes our agent proposes won’t break anything.