Engineering Manager - NodeZero Tripwires

What You'll Do

We're hiring an Engineering Manager to lead the team behind NodeZero Tripwires. Deception has always been a good idea and a hard problem. Honeypots were too heavy. Honeytokens were too easy to scatter in the wrong places, and defenders drowned in alerts they couldn't trust. The hardest part was never building a decoy. It was knowing where to put it.

You'll lead a team, set the technical bar, partner with Product on the roadmap, and work closely with our Attack team to keep tripwire design grounded in current adversary tradecraft. You'll be in design reviews, you'll be the one asking why an alert fired, and you'll own the standard. Signal-to-noise is not a metric for this product. It is the product.

In this role, you will:

• Own the delivery strategy for Tripwires: decoy and deception development, detection, alerting, and the customer-facing experience around them.

• Partner closely with Product to sequence the roadmap, and expand Tripwires coverage.

• Recruit, mentor, and retain engineers who care about both distributed systems craft and the security domain.

• Oversee the design of new tripwire types that are attractive to attackers and indistinguishable from legitimate assets.

• Invest in operational excellence; SLOs, observability, on-call, and incident response.

• Partner with the Attack team to create tight feedback loops so new offensive findings translate into new detection coverage.

• Establish healthy team practices: design reviews, technical writing, clear API contracts with neighboring teams, and durable decision records.

What You'll Bring

• Experience managing backend, data, or platform engineering teams, with a track record of shipping through the team.

• Solid fundamentals in backend and distributed systems: data modeling, API design, queues/streams, and the tradeoffs between batch and streaming.

• Comfort with modern cloud infrastructure (AWS preferred), containers, and observability tooling (Datadog or similar).

• Ability to lead through technical ambiguity — you can facilitate a design discussion, help the team converge, and know when to dig in yourself.

• Clear written communication: you can put together a roadmap, a design doc, or a postmortem the rest of the company can read.

• A sense of ownership for how the team operates day-to-day, not just what it ships.

• Working knowledge of deception technology: honeypots, honeytokens, canaries.

Nice to have:

• Exposure to event-driven architectures or streaming platforms (Kafka, Pulsar, Kinesis, Flink, or similar).

• Understanding of how attackers move through an environment post-compromise: credential access, lateral movement, and privilege escalation.

• Background in cybersecurity, pentesting, or vulnerability management.

• Familiarity with Python and/or Go.