Senior Software Engineer, Investigations & Cases

Security Platform Engineering
· Atlanta, Denver, Remote
· Open

At Todyl, we are on a mission to protect small and medium-sized businesses from ever-changing cyber threats. The Todyl platform fully integrates threat, risk, and compliance management to provide exceptional and affordable unified cybersecurity solutions to MSPs (Managed Service Providers) and their end customers.

At the end of the day, we're here to keep our partners and customers safe and help them manage the risks and comply with regulations. Protecting others requires a team that works together with trust and cares deeply about carrying out our mission.

We are looking for a Senior Software Engineer to build the systems our analysts and partners live in — the investigation surface where our SOC works alerts, the case that carries a finding to the partner, and the automation that moves work between them. A detection firing is the start of the job. Everything after it happens in your systems.

This is a hands-on build role. Most of your week is building — designing services, shipping them, and carrying the operational half, on-call included. You will not be writing detection content, which Detection Engineering owns, or setting analyst practice, which our Detection & Response Operations lead owns. They decide how alerts get worked. You own the system they get worked in.

This role reports to the Senior Manager, Security Platform Engineering, and can be based in our Atlanta or Denver offices or remotely within the US. You will own services across Investigations, Cases, and the automation between them, and you will work directly with our SOC — they are the people using what you build, on every shift, and the fastest way to know whether a change landed is to ask them.

• Investigation Surface: Build and evolve the tooling our analysts use to triage and investigate — pivoting across telemetry, gathering evidence, and recording what they found. Spend enough time with analysts to know where the workflow actually hurts.
• Alert-to-Case Lifecycle: Build and own services along the path from signal to case to resolution — state, ownership, handoff across shifts and sites, and the audit trail. Make the case surface something a partner reads and immediately understands.
• Response Automation: Build response actions and playbook capabilities on our SOAR and workflow layer, including the approval gates that keep a person in the loop where one belongs, and the checks that catch AI-assisted output before a partner sees it.
• Integrations: Build partner-tool integrations and sharpen the framework underneath them as you go, so the next integration is cheaper than the last rather than another entry on a pile.
• Operability: Instrument what you build so failures surface before partners feel them. Own latency, throughput, and the failure modes that only appear at multi-tenant scale, and join the on-call rotation for your services.
• Craft & Review: Write the design docs for your own work and bring them to review early. Raise the bar around you through code review and pairing, and mentor engineers earlier in their careers.

• Extreme ownership, particularly when things go wrong or aren't completed on time.
• Intrinsic drive for growth; self-motivated, always learning, and focused on raising the bar for self and team.
• Strong bias for action with impact; make tough decisions quickly, measure results, and iterate with clarity to move the mission forward.

• Experience: 8+ years building and operating production software, including 4+ years writing backend services in Go. You have carried production on-call for systems…