Senior Software Engineer, Investigations & Cases in Augusta, Georgia at Todyl, Inc.

At Todyl, we're on a mission to make world-class cybersecurity and networking accessible to businesses of all sizes. Our cloud-native Security Platform brings together SASE, SIEM, Endpoint Security, GRC, MXDR, and more into a unified, single-agent solution purpose-built for MSPs, MSSPs, and mid-market IT professionals.

We're a fast-growing, innovative cybersecurity company focused on simplifying complex security challenges and helping our partners protect their customers against an evolving threat landscape.

Our success is driven by a team that values collaboration, accountability, and continuous improvement. We move quickly, solve complex problems, and take ownership of the technology we build. At Todyl, you'll have the opportunity to make a meaningful impact, tackle challenging technical problems, and help shape the future of cybersecurity.

We are looking for a Senior Software Engineer to build the systems our analysts and partners live in — the investigation surface where our SOC works alerts, the case that carries a finding to the partner, and the automation that moves work between them. A detection firing is the start of the job. Everything after it happens in your systems.

This is a hands-on build role. Most of your week is building — designing services, shipping them, and carrying the operational half, on-call included. You will not be writing detection content, which Detection Engineering owns, or setting analyst practice, which our Detection & Response Operations lead owns. They decide how alerts get worked. You own the system they get worked in.

This role reports to the Senior Manager, Security Platform Engineering, and can be based in our Atlanta or Denver offices or remotely within the US. You will own services across Investigations, Cases, and the automation between them, and you will work directly with our SOC — they are the people using what you build, on every shift, and the fastest way to know whether a change landed is to ask them.

• Investigation Surface: Build and evolve the tooling our analysts use to triage and investigate — pivoting across telemetry, gathering evidence, and recording what they found. Spend enough time with analysts to know where the workflow actually hurts.
• Alert-to-Case Lifecycle: Build and own services along the path from signal to case to resolution — state, ownership, handoff across shifts and sites, and the audit trail. Make the case surface something a partner reads and immediately understands.
• Response Automation: Build response actions and playbook capabilities on our SOAR and workflow layer, including the approval gates that keep a person in the loop where one belongs, and the checks that catch AI-assisted output before a partner sees it.
• Integrations: Build partner-tool integrations and sharpen the framework underneath them as you go, so the next integration is cheaper than the last rather than another entry on a pile.
• Operability: Instrument what you build so failures surface before partners feel them. Own latency, throughput, and the failure modes that only appear at multi-tenant scale, and join the on-call rotation for your services.
• Craft & Review: Write the design docs for your own work and bring them to review early. Raise the bar around you through code review and pairing, and mentor engineers earlier in their careers.

• Extreme ownership, particularly when things go wrong or aren't completed on time.
• Intrinsic drive for growth; self-motivated, always learning, and focused on raising the bar for self and team.
• Strong bias for action with impact; make tough decisions quickly, measure results, and iterate with clarity to move the mission forward.

• Experience: 8+ years building and operating production software, including 4+ years writing backend services in Go. You have carried production on-call for systems you designed.
• Distributed Services: Demonstrated experience designing, building, and operating services in a distributed, event-driven architecture — data model, API, asynchronous processing, and behavior under load. You have drawn service boundaries and lived with the consequences.
• State & Correctness: Hands-on with systems where the hard problem is state rather than throughput — entity lifecycles, ownership transfer, concurrency between users, idempotency under at-least-once delivery, and audit trails that stay defensible months later.
• Streaming & Analytical Production experience with an event streaming platform (Redpanda, Kafka, or equivalent) and a columnar analytical store (ClickHouse or equivalent). You can explain the access patterns each is suited to and design accordingly.
• Operator-Facing Systems: You have built and owned an application that professional operators use as their primary working surface. You can tell a feature request from a workflow problem, and you have shipped changes that measurably cut the time a task takes.
• Integrations & Automation: Experience building and maintaining integrations against third-party APIs you do not control — retry strategy, rate limiting, partial failure, and schema drift. Familiarity with SOAR or workflow-automation platforms (Torq, Tines, XSOAR, Swimlane, or a homegrown equivalent) and with PSA and RMM tooling in the MSP channel is a strong plus.
• Security Operations Domain: Working knowledge of detection and response — how a detection becomes an alert, how an analyst triages and investigates it, and why false positives are expensive. Prior work at a security vendor, MDR, MSSP, or on an in-house SOC tooling team.
• Partner Awareness: Familiarity with MSP/MSSP or multi-tenant environments, where one customer's volume can affect another.
• Education & Certifications: Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent practical experience. Contributions to open security or detection tooling are a plus.

Benefits & Perks

At Todyl, we believe in investing in our people and creating an environment where employees can thrive both personally and professionally. We offer a comprehensive benefits package designed to support well-being, flexibility, and long-term career growth.

Our benefits include:

• Equity Ownership: Opportunity to share in Todyl's growth and success through our employee equity program. We believe in giving our team a meaningful stake in the company we're building together.

• Health & Wellness: Comprehensive medical, dental, and vision insurance options to support you and your family.

• Unlimited PTO: Flexible, unlimited paid time off to recharge, prioritize personal well-being, and maintain a healthy work-life balance.

• Retirement Savings: 401(k) plan to help you invest in your financial future.

• Paid Parental Leave: Dedicated paid leave to support employees as they grow their families.

• Hybrid Work Environment: A collaborative hybrid work model with offices in Denver's LoDo neighborhood, Midtown Atlanta, and Augusta, GA, balancing in-person collaboration with flexibility

• Commuter Benefits: Parking and public transportation benefits to help make your commute easier and more convenient.

• Professional Growth & Development: Opportunities to expand your skills, take on new challenges, and grow your career alongside a rapidly evolving cybersecurity company.

At Todyl, you'll have the opportunity to make a real impact, take ownership of meaningful work, and share in the success of what we're building together.

The anticipated base salary range for this position is $160,000-190,000 annually, with final compensation determined based on experience, skills, qualifications, and other job-related factors.