Forward Deployed Security Engineer

We are looking for forward-deployed security engineers who want to build the future of security operations with agents.

Tracecat helps AI-native security teams move at machine speed with agents they own and control. Our users automate security operations across detection and response, cloud, infrastructure, identity, vulnerability management, compliance, and internal workflows.

You’ll work directly with the founders and our customers, architect agents that automate real security work, and turn what you learn in the field into product capabilities that run in mission-critical environments. This is a high ownership role at an AI-native open core company winning deals against competitors 100x their size.

What you’ll do

You won’t just field customer requests. You’ll shape how security teams use agents to run security work.

• Work directly with security teams to design and deploy agentic systems across their security stack
• Build agents that investigate alerts, gather evidence, reason over context, recommend decisions, and trigger approved actions
• Build Python integrations, agent skills, MCP tools, and data pipelines that give agents the context and tools they need
• Design agents for detection and response, cloud findings, identity investigations, vulnerability response, case management, and recurring security operations
• Evaluate agents for accuracy, approvals, auditability, failure modes, and analyst experience
• Work with the founders and product team to turn repeated customer patterns into reusable agents and product capabilities

What you bring

• Security judgment: you understand how teams investigate, prioritize, and respond to risk across cloud, infrastructure, identity, and production environments
• Hands-on experience in security engineering, cloud security, infrastructure security, detection and response, incident response, product security, application security, or a related role
• Strong Python skills and experience building APIs, integrations, data pipelines, internal tools, or production automation
• Product intuition: you can turn one-off customer problems into reusable product primitives
• Customer empathy: you can work with analysts, responders, security engineers, security leaders, and founders without losing the technical thread
• Comfort working in a small team where speed, ownership, and ambiguity are the norm
• Technical craftsmanship: we’re an anti-slop AI-pilled company, and security automation should be auditable, testable, and boring when it matters
• Slope over intercept: we value learning velocity, grit, and unapologetically unique personalities

Bonus

• Prior experience building agents, copilots, MCP servers, tool-calling systems, evals, or sandboxed automation
• Prior experience as a forward deployed engineer, founding engineer, security engineer, incident responder, detection engineer, cloud security engineer, infrastructure security engineer, or security consultant who still writes code
• Experience with production security tooling across SIEM, EDR, cloud, identity, infrastructure, or vulnerability management
• Familiarity with security frameworks, investigation languages, cloud audit logs, IAM, or infrastructure-as-code
• Threat hunting, adversary emulation, red team, or offensive security experience
• Experience deploying software into customer VPCs, on-prem environments, regulated environments, or high-assurance networks
• Open source contributions or experience working in large production codebases

Company benefits:

• Competitive compensation and meaningful equity
• 20 days paid time off every year
• 15 days of remote work flexibility per year
• 100% coverage for health, dental, vision
• Wellness stipend to spend on gym, spa, or whatever keeps you at your best
• Free lunch
• Team offsites

Interview Process

• 30 minute introductory call
• 2 hour decomp and technical interview
• 2 day on-site at our New York office