Senior Software Engineer (Agentic Systems)

• StackHawk builds the security layer for AI-assisted engineering
• Our platform finds exploitable vulnerabilities in running applications and APIs, then hands the proof and the fix path directly to the coding agent already sitting in the developer’s editor
• Claude Code, Cursor, Copilot, Codex
• Scan, fix, verify, in a loop, without a human copying findings between tabs
• That product is real and shipping
• It is also early, which means the architecture decisions that matter most have not been made yet
• We are looking for a senior engineer to own that loop
• You will spend most of your time on agentic systems: the tool surfaces our agents call, the context they get, the loop that decides when a fix is actually verified, and the evals that tell us whether any of it got better this week
• You will also work in the core platform, because the loop is only as good as the scan engine and APIs underneath it
• This is not a research role
• Everything you build goes to customers
• The team is small. Your work will be visible in the product within days, and in customer conversations within weeks
• Design and build the find, fix, and verify loop that powers our agentic security workflows
• Build and own the tool layer coding agents use to reach our platform. Some of this exists and needs a rewrite. You will have a strong opinion about how, and the room to act on it
• Extend our published agent skills, which are open source and in use today
• Do the context engineering work that makes the difference between a useful agent and a plausible one. Decide what the model sees, in what shape, and at what point in the loop
• Build eval harnesses for non-deterministic systems. Define what “better” means, measure it repeatably, and defend the number
• Build core product features and supporting services in a microservices architecture using Kotlin, Java, Rust, gRPC, Postgres, Docker, Kubernetes, and Gradle
• Design and build APIs for both our UI and our customers
• Build developer-facing command line tooling
• Integrate with the platforms engineers already live in: GitHub, GitLab, CI systems, IDEs, and agent runtimes
• Work directly with product, security, and go to market. We are small enough that you will hear customer feedback firsthand and ship against it
• Learn more about vulnerability classes than you expected to, and get very good at explaining Remote OS Command Injection at parties

Benefits

• Solid Benefits: Health, dental, and vision insurance 100% paid for employees and dependents. Other benefits include life insurance, AD&D, and 401K
• Parental Leave: 16 weeks for primary caregivers and 4 weeks for secondary caregivers
• Flexible PTO: We do not restrict the number of vacation or sick days you take in a given year, and we encourage you to take time off to fully unplug, recharge, and come back refreshed
• PAID Vacation (who does that?): We offer a $3000 bonus for hawks who take a week or more of vacation after their second year with us
• Fun Team and Perks: We do great work and have fun doing it! We take care of our employees… We’ll contribute to your WFH setup and hook you up with occasional at-home perks. Plus, work with a team that loves to have fun while doing our work!- Are you looking to build tools that engineers actually keep in their workflow?
• Do you get excited about AI agents that fix real vulnerabilities instead of writing confident nonsense about them?
• Are you willing to tolerate ridiculous bird puns? If you said yes to at least two of those, keep reading
• 6+ years building and shipping production SaaS software
• Obsessive about automation and automated testing
• Experience with microservices in a modern cloud environment, containers, and container orchestration
• Our core platform is Kotlin and Java. We do not require you to have written either. If you are strong somewhere else, you will be productive in our codebase inside a month and we are fine with that math
• Deep in at least one statically typed language. Python, TypeScript, Go, or Rust experience is where our agent tooling and CLI live, so that helps immediately
• Solid API design instincts and the tooling that goes with it
• Bonus: you have built or published MCP servers, agent skills, or custom agent integrations
• You have done real context engineering. You know that most agent failures are context failures, and you have the debugging stories to prove it
• You have built something with an agent loop, not just called an LLM API. Tool calling, multi step execution, retries, failure handling, knowing when to stop
• You have written evals for non-deterministic output. You can talk about what you measured, why that metric was the right one, and what it missed
• If your agentic experience is one weekend project and a course certificate, this is not the right role yet. If it is a system you shipped, maintained, and had to debug at 11pm, we want to talk
• Accountable. You own outcomes, not just tickets. When something you shipped breaks, you are already looking at it
• Focused. You finish things before starting new things
• Persuasive. You bring people to your position with logic and data, not volume
• Self motivated. You do not need to be told what matters twice
• Collaborative. You know security is a supporting function of a business, and you know the difference between binary security and security at scale