About Hinoki Security
AI is collapsing the cost of offense. What used to require a skilled exploit developer can increasingly be automated, and defenders are still working from tooling that was designed two decades ago: tools that produce endless lists of findings without telling anyone what actually matters or what to do about it.
Hinoki is building the AI-native platform that fixes this. We continuously map an enterprise's real exposure, figure out what is genuinely dangerous in the customer's specific environment, and drive the remediation through to verified resolution. Old scanners produce lists. We produce fixes.
We're backed by Andreessen Horowitz and led by a second-time security founder, most recently from Google. The platform is already in production at Fortune 500 enterprises.
The role
This is a critical engineering hire with broad ownership over core platform infrastructure. Depending on your strengths, you may lead the systems that orchestrate our research agents, the data layer that models a customer's environment in real time, the verification surfaces that prove our agents' work is correct before anything reaches a customer, or the reporting surfaces where our hard-work translates to CISO-level impact.
Engineering culture
We have a high bar for taste and quality. There's too much AI slop in the world, and we would like to see less of it.
Every decision the product makes has provenance: why we believe what we believe, who owns it, what evidence supports the next action. We invest heavily in the internal frameworks that let our humans, our coding agents, and our production agents work fast while minimizing mistakes.
What we're looking for
Three to six years of engineering experience, plus:
AI agents in production. Not prototypes. Real autonomous systems with multi-step reasoning, tool use, memory, evaluation, and failure handling.
Distributed systems chops. You've shipped systems with real failure modes: leases, retries, idempotency, blast-radius reasoning.
Cloud fluency. Production depth in at least one of AWS, Azure, or GCP.
AI-native workflow. Claude Code, Codex, or Cursor is in your daily loop. You can articulate where these tools help and where they don't.
High agency. You read a plan doc and ship. You don't wait for tickets. You fix what's broken regardless of whose code it is.
Taste for small, reversible changes. You know when to extract a helper and when to keep code inline. You don't ship 800-line refactors when 30 lines would do.
We work in TypeScript and C++ but care more about engineering depth than specific languages. No security background required. We'll teach you the domain.