About the role

Backend Engineer (Threat Hunting Platform)

Own core backend systems that power Nebulock’s agentic threat hunting and detection workflows.

Role Overview

Co-own the data ingestion, transformation, and search layers used by customers
Build systems that support large-scale telemetry processing (TBs/day)

Responsibilities

Design, build, and maintain scalable systems for ingesting and processing large volumes of security telemetry
Develop and own integrations across data sources (e.g., EDR, IAM, Cloud, SaaS)
Build the transformation layer to normalize, enrich, and model data for querying
Create a correlation engine to link entities across disparate data sources
Develop and operate real-time and batch processing systems
Work on core search capabilities across vast datasets
Collaborate with detection engineers, threat hunters, and product engineers to ensure data quality and correct structure
Help drive platform architecture and technical direction

Requirements

4+ years building backend distributed systems and working with data
Proficiency in Python, Java, Go, or Rust (or similar)
Experience with AWS or GCP
Strong background in data pipelines
Experience with event-driven systems
Strong system design, data modeling, and understanding of performance trade-offs
Experience with OLAP databases
Ability to adapt quickly, iterate, and ship
Prefer low-ego, growth-oriented team mindset

Nice to Haves

Experience with streaming processing engines such as Apache Flink
Experience building/working with search systems over large datasets
Cybersecurity experience
Startup experience

What We Offer

Fast growth in a dynamic startup environment
Collaborative culture emphasizing innovation
Competitive salary and equity, plus comprehensive benefits (including 401(k))
Opportunity to travel for conferences and workshops

About Nebulock

Nebulock is an agentic threat hunting platform for security teams that autonomously identifies behaviors and signals across multiple telemetry sources, not just indicators of compromise (IOCs). It continuously hunts across endpoint, identity, and cloud telemetry, then turns findings into hardened, behavior-based detections. The company focuses on building scalable data ingestion, reasoning, and detection workflows for modern threat detection engineering.

Tags