Build the layer
underneath.
SecurityVault is a small, founder-led team. We are not running open requisitions right now, but we read every note from people who want to work on deterministic security tooling — and we hire when the right person turns up.
Make every security decision provable.
For four decades the industry has shipped scanners. Findings pile up. Decisions live in PDFs. Auditors get screenshots. We're building the layer underneath — a hostile-by-default scan band, one finding ontology and a signed audit chain — so that every yes, no, and exception is reproducible, fast, and audit-ready by construction.
Six things we believe.
Six things we will fight for.
These are not posters. They show up in code review, hiring debriefs, planning, and the postmortems we publish.
Determinism beats heroics.
We ship systems that are correct because they have to be. Same inputs, same outputs, every time — for our engine, our deploys, and our hiring decisions. If the answer depends on who was on call, we built it wrong.
Evidence over assertion.
If you can't link a claim to an audited event, it's an opinion. Internal docs, design proposals, and customer commitments include their proof: what would change if this was wrong, and how would we know?
Plain language.
Security is full of jargon designed to obscure. We write docs, error messages, and auditor packs in language a smart non-specialist can read. If the explanation needs three acronyms, we haven't understood it yet.
Slow hires, slow fires.
Most hires take 6–10 weeks because we want both sides to be sure. We extend offers with a 14-day decision window. We give written feedback to every onsite candidate, even the ones we don't extend to.
Async-default. Synchronous-deliberate.
Most communication is in writing — design docs, postmortems, RFCs. Synchronous time is reserved for genuinely interactive work. We work across 11 time zones; we believe the calendar is a budget, not a default.
Treat users like operators.
Our customers are security teams who run things at 3 a.m. We design for them: terminals, keyboard shortcuts, structured logs, dry-run replay, predictable failure modes. Software that respects operators is software that holds up under load.
Tell us what you
would want to build.
Send a short note and something you have shipped. We reply to everyone, and we keep notes on file for when a role opens.