Founding Engineer – Cybersecurity

About the Job

Build the tooling that scales our work and keeps our clients one step ahead.

Invictus is a Dutch cloud incident response company. We get called when organizations are hit by data theft or targeted attacks in their cloud environments, and we are the ones who get the attacker out, map the damage, and help the company get back on its feet. Our clients range from scale-ups to publicly traded companies.

We are, and will remain, a services company. However, our consultants and responders haven’t worked without proprietary tooling for years. We actively contribute to the open-source ecosystem used by the IR community, and internally we have a growing stack of proprietary tools that we deploy during investigations and assessments. We want to seriously scale up that development. Not to launch some random SaaS, but because better tooling makes our work faster, more scalable, and more demonstrable—and because our clients are increasingly asking for continuous insight into their risks before anything actually happens.

For this next step, we are looking for our first full-time engineer.

What You Will Do

You will work on two types of things, side by side:

• Develop new products that give clients insight before an incident occurs. Think of IR readiness assessments that run on data instead of checklists, and lab environments where teams can train on realistic scenarios. You will start with the architecture and help build the first versions.

• Improve and expand our internal and open-source IR tooling. Forensic data acquisition in cloud environments (AWS, Azure, GCP, M365, Google Workspace), parsers for cloud logs, automation around triage and evidence collection, and dashboarding for ongoing investigations. A lot of this is already in production or on our GitHub—you will make it better, faster, and more broadly applicable.

In both tracks, you are the one making choices regarding the stack, structure, and direction. You will work closely with our IR experts—they know what is needed in the field, and you will translate that into code that works.

Who We Are Looking For

• 5+ years of experience as a platform / full-stack / backend engineer.

• Strong in a modern backend language (Python, Go, or Rust) and comfortable with frontend work when necessary.

• Cloud-native through and through: AWS, Azure, and/or GCP, containers (Docker/Kubernetes), Infrastructure as Code (Terraform or similar).

• Affinity with security and cloud internals: You don’t need to be a DFIR specialist, but you shouldn’t shy away from cloud provider APIs, logging pipelines, and identity stacks.

• Open-source mindset: You have contributed to projects yourself, or you consider it standard practice to do so.

• You work independently and can balance scope, planning, and tech against each other—there is no tech lead above you.

• Pluses: Experience with DFIR tooling (e.g., Velociraptor, Volatility, Plaso, KAPE, cloud-forensics tools), taking a SaaS from 0 to 1, or security tooling such as ASM/EASM, vulnerability management, or detection engineering.

What This Is Not

This is not a role where you grab tickets from a sprint and review code for an existing application. You are a founding engineer. That means ownership, but it also means working in a small team where not everything has been figured out yet. If you prefer to work within rigid processes and clear team structures, this is probably not the place for you.

What We Offer

• Market-competitive salary (Indication: €75k – €100k depending on experience) plus a bonus/equity scheme open for discussion during the interview.

• Claude license 😉

• Full role in the core team from day 1, with a direct impact on how we do our work.

• Working on tooling that benefits the wider IR community (open source remains a first choice wherever possible).

• Remote-first—no fancy office tower with a barista, but the freedom to do your work from your favorite spot.

• 25 vacation days, pension plan, laptop & hardware of your choice.

• Short lines of communication—decisions aren’t pushed down the line; they are made.

Working at Invictus

We are small, no-nonsense, and want to do the best work in our field. What defines us: taking technology seriously, being honest about what does and doesn’t work, and having fun doing difficult work. No consultants-in-suits, no vague stories—just people who are calmer than you at 3:00 AM when you’ve just realized your entire cloud tenant has been compromised.