SubImage (YC W25) Is Hiring a Founding Engineer in SF
🚀 SubImage (YC W25) is Seeking a Founding Engineer in San Francisco
SubImage is building the Open-Core Security Graph, and we need a powerhouse engineer to join our core team. We are mapping digital infrastructure through the lens of an adversary, enabling enterprise security teams to identify and remediate vulnerabilities before they are exploited.
📋 Job Overview
| Detail | Specification |
|---|---|
| Role | Founding Engineer (Backend/Engineering) |
| Compensation | $170,000 — $230,000 |
| Equity | 0.50% — 1.00% |
| Location | San Francisco, CA (Full-time, In-office) |
| Experience | 3+ years |
| Eligibility | US Citizens or Visa holders only |
| Core Skills | Python, Distributed Systems |
🎯 The Mission
Our foundation is built upon Cartography, a CNCF project and open-source tool created by our founders during their time at Lyft. It has already been integrated by over 70 organizations.
We are currently a lean, seed-stage team of four, but our trajectory is steep. We are already serving high-profile clients—the kind of names your parents recognize.
"This is a rare opportunity to join a high-potential venture at the ground floor. Of course, it's a startup: we'll either build something massive or discover very quickly that the idea doesn't scale. That's the honest reality of startup life."
🛠️ Complex Engineering Hurdles
We are chasing the "holy grail" of security. Our work involves deep graph theory, where we define the environment as a graph . We need to solve:
- Reachability & Validity: Are vulnerabilities actually exposed to the internet? Are the affected functions reachable in the code? Do existing controls render the vulnerability moot?
- Impact Analysis: If a breach occurs, does it actually lead to sensitive data?
- Safe Remediation: How do we mathematically prove that a proposed security patch won't crash the system?
- Real-time Visibility: Creating a self-updating, near-instant map to stop attacks in progress.
- AI Integration: Training agents to query our graph with precision, providing exact context without hallucinations.
- Identity Heuristics: Using logs, tags, and files to determine the actual owner of a resource.
- Compliance State: Managing the lifecycle of vulnerability management sustainably.
- Temporal Analysis: Implementing "time travel" to replay attacks exactly as they unfolded.
# Conceptual example of a graph query for reachability
def check_attack_path(start_node, target_asset):
path = graph.find_shortest_path(start_node, target_asset)
if path and path.is_exploitable():
return "CRITICAL: Reachable Path Found"
return "Secure"
👤 Who You Are
We are looking for a builder who thrives in high-growth environments.
- Experience: 3+ years at rapidly scaling companies.
- Location: Based in the SF Bay Area and excited to be in the office
remotely5 days a week. - Mindset: Willing to tackle "gnarly" business logic to save
exhaustedjaded security engineers from burnout. - Impact: Ready to ship code that impacts 70+ external companies.
Our Current Tech Stack Highlights:
Sveltefrontend paired with a proprietary, high-performanceWebGLgraph renderer.- An
MCPserver that bridges our platform's graph data to AI agents.
🎁 Benefits & Perks
- Health: Comprehensive Medical, Vision, and Dental.
- Financial: 401k matching (a rarity for early-stage startups!).
- Lifestyle:
- Unlimited PTO.
- Gym membership.
- Daily team lunches.
🛣️ The Interview Journey
🏢 About SubImage
We leverage graph theory to visualize customer environments, allowing them to neutralize threats before a hack occurs. Our core technology, Cartography, was donated to the Linux Foundation and is utilized by over 70 companies, including seven of the Fortune 100, to manage infrastructure across AWS, Okta, GitHub, and more.
Our team is a blend of security, infrastructure, and AI enthusiasts with pedigrees from Lyft, Anthropic, and the NSA.
👥 Leadership
Alex Chantavy — CEO
