Miggo Security

AI-Driven Backend Engineer

We’re Miggo — a cybersecurity startup on a mission to stop app-layer breaches before they happen. Founded in 2023 and backed by top-tier cyber VCs, we’re building the world’s first Application Detection & Response (ADR) platform. Why? Because 80% of cyber attacks target the app layer, and current tools just don’t cut it. Miggo brings visibility into how apps actually behave at runtime, spotting risky flows and shutting down threats in real time. If you're excited to shape the future of AI-driven application security from the inside out — join us. At Miggo, we live by four core principles: • We make it customer-focused, putting user needs at the heart of everything we build. • We make it happen, driven by a can-do mindset and obsession with winning. • We make it better, always pushing boundaries, learning fast, and owning our impact. • We make it together, one team that collaborates, laughs, and thrives on diverse perspectives What you'll do Miggo is looking for a Senior Backend Engineer with a strong passion for AI and intelligent systems to join our growing R&D team. In this role, you’ll be building the backend foundation that powers our AI-enhanced security analytics, autonomous detection, and real-time decisioning systems. You’ll work closely with AI engineers, product, and security experts to bring agentic intelligence into Miggo’s runtime platform — transforming how modern apps defend themselves. You’ll architect and implement services that scale to massive volumes of runtime data, integrate large language models (LLMs), and support RAG-based workflows for contextual understanding and response. You’ll Be Great For This Role If You Love To: • Design and build scalable, resilient backend services that power Miggo’s AI-driven runtime security platform. • Integrate LLMs and agentic AI components into production environments to enable autonomous detection and remediation capabilities. • Design evaluation frameworks for measuring model performance and reliability in real-world conditions. • Develop Retrieval-Augmented Generation (RAG) pipelines tailored to application security data. • Own backend architecture decisions — from data modeling to performance optimization — across Node.js, Python, and cloud-native environments. • Contribute to our infrastructure, leveraging CI/CD, Kubernetes, Docker, and modern observability practices. • Mentor peers and help shape Miggo’s AI engineering culture. What you have • 5+ years of backend development experience, ideally building scalable and distributed systems. • Deep expertise in Python and modern cloud-native architectures. • Proven experience with AI-enhanced systems — integrating or working with LLMs, RAG, or machine learning pipelines. • Understanding of data-intensive architectures, including streaming, caching, and dataflow optimization. • Strong collaboration and communication skills, with the ability to translate AI concepts into production-grade systems. • Advantage: Familiarity with vector databases, prompt engineering, and evaluation frameworks for AI models. • Advantage: Background in cybersecurity, runtime analysis, or agentic AI design patterns. Why You'll Love Working at Miggo? At Miggo, you’ll join a team that’s pioneering the next era of application security — one where AI and runtime intelligence work hand in hand to protect modern software. You’ll have autonomy, real ownership, and the opportunity to shape both our platform and the future of intelligent cybersecurity. We’re small enough for you to make a visible impact — and bold enough to tackle one of the hardest challenges in the industry.

Product Manager Tel Aviv · Product About Miggo Miggo is closing the patch gap. We created the Application Detection and Response (ADR) category to give security teams runtime visibility into what's actually happening inside their applications — what's reachable, what's exploitable, and what's being attacked right now. And we don't stop at seeing it: when a patch isn't ready, Miggo provides targeted mitigations that shield the application in real time — protecting what's exploitable while the fix catches up. Backed by top-tier investors and trusted by leading enterprise security teams, we're building the category-defining platform for runtime application security. About the role We're looking for a Product Manager to own Miggo's Runtime Domain — the engine that powers vulnerability intelligence, attack detection, sensor capabilities, and our application DNA (appDNA) model. This is the technical core of the product, where security research, runtime telemetry, and product judgment meet. At Miggo, product management is an engineering discipline. You'll be expected to go deep on the technology, hold your ground in technical debate, and ship — not just write specs. This role reports to the Senior Director of Product. What you'll do • Own the roadmap for detection, vulnerability intelligence, and sensor capabilities. Decide what we build, kill, and punt. • Partner with security research daily — turn raw findings, new CVE classes, and exploitation patterns into shippable product. • Write specs engineers respect. Argue about data models and detection quality, not pixels. • Run design partnerships with enterprise security teams. Sit with them, watch them work, come back with conviction. • Run discovery sessions with customers to maximize the value from the Miggo platform. • Use AI tooling as a force multiplier in your own workflow — prototyping, evals, internal agents. Not as a feature you slap on. What we're looking for • Strong technical background — Must. Engineering, security research, or equivalent hands-on technical role. You can read a stack trace, reason about request flow through a service, and have a point of view on why existing AppSec categories under-deliver. • Security research background — Must. Application security, vulnerability research, offensive security, or a technical military intelligence role. Comfortable going deep on CVE classes, exploitation patterns, and runtime signals. • Product experience. Formal PM, founding engineer with product instincts, or a tech lead who shaped what shipped. We care about evidence you delivered things customers actually used — not the title on your last business card. • AI-native operator. You've built something with modern AI tooling — an agent, an eval harness, a workflow — not just used it. • Hands-on by default. Comfortable in fast-paced startup environments where there's no one to hand the work off to. • Clear writer in English. Slack messages, specs, customer notes. Compression matters. Two questions we'd like you to answer Skip the cover letter. Send us: • The most technical thing you've shipped or researched — and what you'd have done differently. • One detection, vulnerability, or AppSec product on the market that you think gets it wrong — and why.

Product Manager

DevOps / SRE Engineer

About Miggo Miggo is building the next generation of application security. We operate a high-scale, data-intensive platform and are looking for a strong DevOps Engineer with SRE capabilities to join a strong, ambitious team. This is an opportunity to have real impact on the company and help build something big from the ground up. The Role You'll own and evolve the infrastructure and reliability of our production platform — a distributed, data-heavy system running on AWS and Kubernetes. You'll work closely with engineering to keep our services fast, reliable, and observable as we scale, while continuously improving our automation, deployment, and operational processes. This role is a fit for someone responsible and hands-on, who wants to contribute to the team effort, take ownership, and keep learning and expanding their capabilities. What You'll Do • Design, build, and operate scalable, resilient infrastructure on AWS and Kubernetes. • Own reliability: define SLOs/SLIs, improve observability, and drive down toil through automation. • Manage and tune our core data and workflow systems — ClickHouse, PostgreSQL, Kafka, and Temporal — for performance and reliability at scale. • Build and maintain CI/CD and GitOps workflows using ArgoCD and GitHub. • Manage infrastructure as code with Terraform. • Lead incident response, run postmortems, and drive systemic improvements. • Establish and improve engineering and operational processes suited to a company operating at scale. • Partner with development teams to make the right reliability, cost, and scalability tradeoffs. What We're Looking For • Strong hands-on experience as a DevOps and/or SRE engineer. • Deep experience with Kubernetes and AWS in production. • Solid experience with Temporal, Kafka, PostgreSQL, and ClickHouse. • Experience with Terraform (IaC) and GitOps tooling such as ArgoCD. • Familiarity with processes and practices for companies operating at scale. • A responsible, ownership-driven mindset with strong collaboration and communication skills. • Eagerness to learn, grow, and contribute to a shared team effort. Our Stack AWS · Kubernetes · ArgoCD · Terraform · ClickHouse · PostgreSQL · Kafka · Temporal · GitHub Why Miggo • Big impact: your work directly shapes how we scale and operate. • Build something meaningful: help lay the foundation for a strong, growing platform. • Strong team: work alongside talented engineers who care about quality and ownership. • Growth: room to expand your skills and take on increasing responsibility.

DevOps Engineer

Runtime Sensor Developer | eBPF Expert

We're Miggo — a cybersecurity startup on a mission to stop app-layer breaches before they happen. Founded in 2023 and backed by top tier cyber VCs, we’re building the world’s first Application Detection & Response (ADR) platform. Why? Because 80% of cyber attacks target the app layer, and current tools just don’t cut it. Miggo brings visibility into how apps actually behave at runtime, spotting risky flows and shutting down threats in real time. If you're excited to shape the future of app security from the inside out — join us. At Miggo, we live by four core principles: We make it customer-focused, putting user needs at the heart of everything we build. We make it happen, driven by a can-do mindset and an obsession with winning. We make it better, always pushing boundaries, learning new things and owning our impact. And most importantly, we make it together — one team, working hard, laughing harder, and thriving on diverse perspectives. What you'll do In this role, you’ll write low-level code that hooks deep into runtimes and OS internals (via eBPF) to capture runtime data with near-zero overhead. Basically, you’re creating the “eyes and ears” inside applications, so we can detect intrusions as they happen. You’ll be pushing the envelope of what eBPF and kernel tech can do: tracing syscalls, monitoring network flows, and intercepting anything attackers might exploit. Your work will help determine exploitability and flag compromises instantly – even for zero-day attacks that nobody has seen before. This is a high-impact, experimental role: part engineer, part hacker – optimizing for performance and reliability while you’re bending the rules of the OS. If you love digging into assembly, performance tuning, and building tools that peer into the guts of running software, come join us. You’ll have the freedom to innovate at the lowest levels of the stack (and we promise, no boring corporate kernel modules here – only the fun stuff!). What you have Do you dream in C and know the Linux kernel like an old friend? We need an eBPF wizard to build the secret sauce of Miggo’s platform – our ultra-lightweight, in-app sensor Why You'll Love Working at Miggo? At Miggo, you’ll help bridge the worlds of massive runtime data and intelligent security experiences. You’ll own systems that make our platform fast, reliable, and insightful, and your work will directly shape how users see and understand their security posture. You’ll join a small, passionate team building from the ground up, where your ideas, architecture, and code will have a visible impact every day.

Runtime Sensor Developer

Senior Backend Engineer

Miggo's Pipeline team builds the event-driven data foundation behind the company's Application Detection & Response platform. We transform massive application telemetry into real-time security value, powering detections, correlations, and automated insights across the product. What you'll do • Design and scale event-driven streaming systems using Kafka and Temporal to enable real-time security analysis and decision making. • Build rule-based and data-driven pipelines that turn application signals into actionable detections. • Collaborate with product, integrations, and detection teams to create new data flows that unlock innovative security capabilities. • Lead improvements in scalability, reliability, and observability to keep the pipeline ahead of growth and complexity. What you have • Deep experience with stream processing and distributed systems (Kafka, Flink, Temporal, or similar). • Expertise in data architecture and high-performance querying (ClickHouse, Postgres). • Proven ability to design and own complex systems with clarity and resilience. • Strong engineering fundamentals and curiosity about how data becomes security intelligence. • 7+ years of backend development experience with a focus on distributed systems It would be great if you also have: • Background in security analytics or large-scale data systems. • Experience with multi-tenant, real-time, or high-throughput environments.

Backend Developer

Full time · On-site

AI Tech Lead | Agent Platform & Enablement

Scope: Hands-on technical lead, no direct reports — influence across Copilot & AI, Pipeline, and Experience About Miggo We're Miggo — a cybersecurity startup on a mission to stop app-layer breaches before they happen. Founded in 2023 and backed by top-tier cyber VCs, we're building the world's first Application Detection & Response (ADR) platform. Why? Because 80% of cyber attacks target the app layer, and current tools just don't cut it. Miggo brings visibility into how apps actually behave at runtime, spotting risky flows and shutting down threats in real time. We're closing the patch gap: showing security teams what's reachable, what's exploitable, and what's being attacked right now — and delivering targeted mitigations when a patch isn't ready. At Miggo, we live by four core values: • We make it customer-focused — user needs are our north star. • We make it happen — driven by execution and a can-do mindset. • We make it better — always pushing boundaries and learning fast. • We make it together — one team, thriving on collaboration and diverse perspectives. About the Role Miggo already runs agents in production. Our WAF Copilot takes a freshly disclosed CVE and turns it into a validated, provider-specific WAF rule — a state-driven agent graph that researches the vulnerability, maps the attack surface, composes the rule, then attacks its own output with an independent bypass judge and a false-positive prober before a human is ever offered a deploy. When a weakness survives, the system downgrades its own recommendation and records what it could not prove. That last part is the thesis of this role. An agent that touches production security must prove it works and declare what it couldn't prove. The security industry is about to be flooded with agentic claims nobody can verify. We intend to be the company that made verification legible — and that starts with holding our own agents to a standard we're willing to publish. We're looking for an AI Tech Lead to own that standard across three surfaces: • The platform - Today each agent flow is close to a bespoke implementation. You'll turn our hard-won patterns into shared components, conventions, and infrastructure so the next agent is a week of work rather than a quarter — with evaluation, observability, and cost control built in rather than bolted on. • Enablement - Miggo's advantage compounds only if the whole company is AI-fluent, not just R&D. You'll raise that fluency everywhere — engineering, research, product, GTM — through tooling, patterns, and teaching. • The voice - You'll publish the methodology: how we benchmark agentic security output, how we model residual risk, what we learned failing. This is a category-defining position and we want it argued in public. This is a hands-on lead role with no direct reports. Your authority comes from the quality of what you build and how clearly you explain it. What You'll Do • Define and build Miggo's agent framework — shared components, orchestration patterns, tool interfaces, and conventions that make "how do I build an agent here" a five-minute answer. • Make evaluation a gate, not an afterthought: trajectory testing, golden datasets, offline replay, and per-dimension scoring that runs in CI. Land the release benchmark so promote / hold / rollback is a number, not a vibe. • Own agent observability end to end — the execution graph, tool invocations, intermediate reasoning, latency per step, and quality drift — including the external Temporal-orchestrated flows that are hardest to introspect today. • Own the economics: provider abstraction, model routing by task complexity, small-model substitution where it holds, cost attribution per flow. Thousands of CVEs through a labeling agent is a budget line, not a detail. • Drive latency and determinism in our production agent flows — tighter loops, early stopping, deterministic state machines over prose-in-prompt orchestration. • Raise the company's AI fluency. Build the internal tooling, skills, and playbooks that let every team — not just R&D — work AI-natively, and teach the judgment for when not to. • Partner with security research, product, and engineering leadership so agent capability and product roadmap actually converge. What You'll Have • You've shipped agentic systems to production — real orchestration, tool use, structured outputs, and the failure modes that only appear at scale. Not "I've called an LLM API." • You've built the evaluation discipline, not just consumed it: trajectory tests, golden datasets, regression gates, offline replay. "It seems better" is not a metric, and you have opinions about what is. • Deep backend and distributed-systems engineering. Strong Python, and comfort with workflow orchestration (Temporal or equivalent), streaming, and cloud-native infrastructure. Agent platforms are systems problems wearing an AI hat. • Fluency across the modern agent stack — LangChain/LangGraph-style frameworks, multi-provider routing, structured output contracts, prompt and context engineering — with the judgment to know which parts are load-bearing and which are fashion. • Security literacy. Enough to reason about whether an agent's security output can be trusted, and to argue with researchers on the merits. You don't need to be a vulnerability researcher. • Influence without authority. You'll change how three teams work with no one reporting to you. Show us where you've done that. • Advantage: experience with AI/LLM security — red-teaming agents, prompt injection, or agentic attack patterns. • Advantage: background in cybersecurity, detection engineering, or WAF/mitigation systems. • Advantage: you've driven AI adoption across a whole company, not only an engineering org. We deliberately don't list a years-of-experience bar. Agent engineering is a few years old as a discipline — we care what you've shipped and what you learned when it broke. Why Miggo? Most "AI lead" roles are a greenfield promise. This one isn't: there are real agents in production, real customers behind them, and a genuinely hard standard already half-built. You'll get the leverage of setting how an entire company builds with AI, the autonomy of a hands-on lead with no layers to negotiate, and a platform to argue the methodology in public while the category is still being defined. We're small enough for your conventions to become how Miggo works — and bold enough to publish them.

Tech Lead

WAF Security Specialist

About Miggo We're Miggo — a cybersecurity startup on a mission to stop app-layer breaches before they happen. Founded in 2023 and backed by top-tier cyber VCs, we're building the world's first Application Detection & Response (ADR) platform. Why? Because 80% of cyber attacks target the app layer, and current tools just don't cut it. Miggo brings visibility into how apps actually behave at runtime, spotting risky flows and shutting down threats in real time. We're closing the patch gap: showing security teams what's reachable, what's exploitable, and what's being attacked right now — and delivering targeted mitigations when a patch isn't ready. At Miggo, we live by four core values: • We make it customer-focused — user needs are our north star. • We make it happen — driven by execution and a can-do mindset. • We make it better — always pushing boundaries and learning fast. • We make it together — one team, thriving on collaboration and diverse perspectives. About the Role Miggo's WAF Copilot takes a freshly disclosed CVE and produces a validated, provider-specific WAF rule — researching the vulnerability, deriving the attack surface, composing the rule, then attacking its own output with an independent bypass judge and a false-positive prober before a human is offered a deploy. As WAF Security Specialist you are the ground truth the Copilot is measured against — the person who can look at a generated rule and say this blocks the PoC but not the four obvious variants, this will trip on legitimate multipart uploads, this is 340 WCUs of nothing because the managed ruleset already catches it, this can't be anchored tightly enough to live in a global Web ACL. You'll be shipping rules for real customers — and you'll do it through our AI harness, and help optimize it. In practice that means driving the harness on live work: feeding it a vulnerability, judging what comes back, tightening the match, and validating it against real exploit traffic until it's something you'd put your name on. Sometimes you'll write the expression yourself — the CVE with no public PoC, the emerging threat you have to reason out of a patch diff, the customer who needs coverage this afternoon. Most of the time you'll be applying expert judgment at every step of a generated rule's life, which is a different and harder skill than authoring from a blank page. Because you'll be the harness's heaviest user, you'll also be the reason it gets better. You'll see exactly where it breaks down — the research step that missed the real sink, the composer that over-broadened, the judge that passed a rule it shouldn't have — and turn that into validations, analyses, and evals that go back into the agent. You'll work side by side with the Copilot & AI team so the agent stops making the mistake, instead of you catching it again next month. That feedback loop is the core of this role. All of it rests on knowing where WAFs actually break: normalization and encoding evasion, parameter pollution, body-inspection size limits, oversize-content handling, rule precedence, and the gap between "the rule matched in staging" and "the rule holds against a motivated attacker." An AI can propose a rule. Knowing whether to trust it is the job. What You'll Do • Create - Produce production WAF rules across providers for high-impact CVEs and customer findings — driving the Copilot harness on most of them, writing the expression yourself on the hard ones (no public PoC, exploitable path reasoned out of a patch diff, urgent customer coverage). Your rules ship, and they set the bar generated rules are measured against. • **Optimize -**Tighten generated rules for real production constraints: WCU and rule-capacity budgets, latency, provider expression limits, and the anchoring required for a rule that fires against all traffic behind a shared Web ACL — not just the vulnerable app. • Validate - Own the adversarial pass. Build exploit variants the PoC doesn't cover, hunt bypasses in our own rules, and run the false-positive side seriously — verifying against how the legitimate client actually behaves on the wire, not against an assumption. • Monitor - Watch deployed rules in production: false-positive signals, hit patterns, coverage drift as managed rulesets shift underneath us, and the log→block promotion decision. Retire what no longer earns its capacity. • Make it reproducible - Turn every finding into a regression test. Build and curate the golden CVE datasets and scoring rubrics that gate whether a new Copilot version ships. • Set the coverage line. Judge which CVEs are genuinely WAF-mitigatable and which aren't, and make the call on what enters and leaves our managed rulesets — with the reasoning written down. What You'll Have • Deep, hands-on WAF expertise across multiple major providers — you've written, tuned, and operated real rules in production on several of: AWS WAFv2, Cloudflare, F5, Imperva, Akamai, Azure, GCP, Fortinet, ModSecurity/CRS. Not "managed a WAF vendor relationship" — written the rules. • You know the caveats cold. Body-inspection limits and oversize handling, text transformations and normalization order, encoding and unicode evasion, parameter pollution, chunked and multipart edge cases, rule precedence and evaluation order, WCU/capacity economics, and how each provider's expression language quietly differs from the others. • Strong security research background — application security, vulnerability research, or offensive security. You can read an advisory, build the PoC, derive the variants nobody published, and explain exactly which request component carries the exploit primitive. • A real feel for the false-positive tradeoff. You've had to defend a blocking decision to someone whose production traffic you broke, and you know why "block everything suspicious" is not a security posture. • Comfortable in code. Enough Python (or similar) to automate replay, build variant generators, and query exploit and traffic data yourself rather than waiting on someone. • Fast under pressure, systematic afterward. You can get a solid rule out the door when a customer needs one today — and your instinct once it ships is to build the check that catches the whole class, not just the instance you fixed. • Advantage: virtual patching / vulnerability-mitigation experience, or time on a WAF vendor's rules or research team. • Advantage: hands-on with LLMs and agentic tooling — you'll be shaping an AI system's output, and it helps to understand how it fails. Why You'll Love This Role You'll do the craft work you're actually good at — writing rules against hard vulnerabilities, under real time pressure, for customers who feel the difference. What's unusual is that here it compounds: every rule you write and every bypass you find makes an AI system permanently better at something an expert used to do by hand, across every customer and every future CVE. You get the individual save and the leverage over the whole fleet. You'll have real authority over what we ship and what we refuse to ship, direct access to the engineers building the agent, and a rare seat at the point where security research and AI actually meet in production.

WAF Security Specialist

Security Analyst

We're Miggo — a cybersecurity startup on a mission to stop app-layer breaches before they happen. Founded in 2023 and backed by top tier cyber VCs, we’re building the world’s first Application Detection & Response (ADR) platform. Why? Because 80% of cyber attacks target the app layer, and current tools just don’t cut it. Miggo brings visibility into how apps actually behave at runtime, spotting risky flows and shutting down threats in real time. If you're excited to shape the future of app security from the inside out — join us. At Miggo, we live by four core principles: We make it customer-focused, putting user needs at the heart of everything we build. We make it happen, driven by a can-do mindset and an obsession with winning. We make it better, always pushing boundaries, learning new things and owning our impact. And most importantly, we make it together — one team, working hard, laughing harder, and thriving on diverse perspectives. What you'll do Miggo is looking for a Security Analyst who loves to deeply analyze CVEs and build effective mitigations. Sitting at the intersection of security research and data analysis, you’ll work closely with research and engineering teams across the company to develop high-impact security controls that keep our customers safe. In this role, you will: • Own the answer to “do our mitigations actually work, and how do we know?” • Build tools to evaluate and improve agentic workflows that generate WAF rules and runtime detections. • Prioritize and analyze newly disclosed CVEs on a daily basis to support effective WAF rule creation. • Analyze coverage levels across various CVE groups, attack vectors, and bug classes. • Conduct data-driven research to optimize automated workflows and recommend next-generation mitigation capabilities. • Perform ad-hoc data analysis to support security research and engineering initiatives. You’re a great fit if you: • Love diving deep into newly disclosed CVEs actively exploited in the wild. • Enjoy analyzing complex security data to uncover actionable insights that drive product and engineering decisions. • Want to define and monitor quality metrics that ensure the efficacy of security products. • Excel at collaborating with engineers to trace data flows, identify anomalies, and refine data pipelines. • Continuously question assumptions, challenge inconsistencies, and hold high standards for both data and security integrity. • Naturally lean on quantitative evidence to prove a point and back up your security hypotheses. What you have • 5+ years of experience as a security researcher. • Proven ability to extract, synthesize, and present clear insights from complex security datasets. • Strong quantitative approach to problem-solving. • Prior experience with Web Application Firewalls (WAF) or runtime detections is a plus. • Hands-on experience or background in Data Analysis / Data Science is a strong advantage. Why You’ll Love Working at Miggo? At Miggo, you’ll sit where security research meets real-world data. Your analysis will directly shape how our mitigations are built, measured, and improved, and how our customers stay protected against the newest threats. You’ll join a small, passionate team building from the ground up, where your ideas, research, and insights will have a visible impact every day.

Cybersecurity Analyst