Analysis engines
Native taint analysis, dependency reachability and secrets detection that developers accept because the evidence is on the finding. See SAST.
We build the decision layer for application and cloud security: the graph, the gates and the evidence that let a security team defend every yes, no and exception. We look for engineers, designers and security specialists who want their work to be provable, and welcome introductions relevant to that work.
Security teams need to understand how findings relate to the applications they protect. Our work connects scanner evidence, deployment context and recorded decisions, helping engineers investigate problems and auditors review the supporting records.
Hard problems with a clear standard of done: the answer has to be correct, explainable and verifiable.
Native taint analysis, dependency reachability and secrets detection that developers accept because the evidence is on the finding. See SAST.
Lineage from repository to running workload, attack paths and blast radius, where every edge says how it was established. See the platform.
Fail-closed gates, signed control decisions and audit trails that hold up months later. See continuous compliance.
Six principles that show up in code review, hiring decisions and planning, not on posters.
We value reproducible analysis, explicit inputs and predictable failure modes. Reviews and tests should make it clear how a decision was reached and how someone else can verify it.
A claim without evidence is an opinion. Design proposals and customer commitments carry their proof: what would change if this were wrong, and how would we know?
Security is full of jargon that obscures. We write documentation, error messages and auditor packs that a smart non-specialist can read. If the explanation needs three acronyms, we have not understood it yet.
We take the time for both sides to be sure, keep the process transparent, and give candidates who meet the team clear feedback either way.
Most of our thinking happens in writing: design documents, decision records and post-incident reviews. Time together is reserved for work that is genuinely interactive. The calendar is a budget, not a default.
Our customers are security teams who run things at 3 a.m. We design for them: keyboard-first workflows, structured logs, dry runs and predictable failure modes. Software that respects operators holds up under pressure.
Send a short note about the work you want to do and a public example you can share. We review introductions against current hiring needs. Please do not send confidential work or sensitive personal documents.