Careers.
The outside record of trust between businesses, and the people who run it. Find how an attacker could get into a firm, and close it before it is used. LeakTrace is the outside watch for owner-run firms. We discover every way in we can see from outside, validate every finding, close each opening, and monitor it: email settings, look-alikes and new host names every hour, everything else every day.
We hire slowly and carefully. These are the roles we are building the team around. If one of them is you, write to us.
- Roles
- Six, described below
- Start date
- None fixed. We reply to every serious note
- Where
- Remote, in Canada or the United States
- Write to
- [email protected]
Six roles, each tied to work the product needs.
We are a small company. None of these is a dated opening with a closing day. Each is work we do now and want the right person to own. Open a role to read what you would do and what we look for.
Account Executive, professional firmsTake the owner of a firm from their outside reading to a decision, on the evidence. Read the roleClose
What you would do
- Talk with owners and managing partners at law, accounting, health and insurance firms about what their own outside reading shows.
- Open with the finding and its evidence, not a pitch. One product per conversation.
- Bring in the firm’s IT provider when the owner asks, so the fix steps reach the person who will carry them out.
- Write down what was said and what was promised, so the next person reads the same account you do.
What we look for
- Experience selling to professionals who distrust a hard sell.
- You can read a finding, understand it, and explain it without jargon and without overstating it.
- You are comfortable saying “we cannot see that from outside”.
- Clear, short written follow-up.
Where: remote, in Canada or the United States. Start date: none fixed. To apply: a short note and one piece of your work, by email.
Write to us about this roleAI Data ScientistMeasure what our AI does against checks that do not change, and keep our published figures honest. Read the roleClose
What you would do
- Build the evaluations that compare what a model proposes with what the fixed outside checks record, and report where they differ.
- Look after the LeakTrace Index and our research figures: the sample, the method, the date, and what each number can and cannot support.
- Test each claim we publish against the data it rests on, and say so when the data does not carry it.
- Measure false alarms and misses across the outside checks, and show the result to the people who write them.
What we look for
- Applied statistics, and experience evaluating systems built on language models.
- Python and SQL you would be glad to have someone else read.
- You write a method a non-specialist can follow.
- You would rather publish a smaller number that is true than a larger one that is weak.
Where: remote, in Canada or the United States. Start date: none fixed. To apply: a short note and one piece of your work, by email.
Write to us about this roleSecurity Research EngineerWrite the outside checks, and prove each one reads the world correctly. Read the roleClose
What you would do
- Write new read-only checks of what a firm shows the public internet: email authentication, certificates, DNS, sign-in pages and look-alike domains.
- Keep the accuracy panel: every check run against known domains and compared with standard tools, so a false alarm is caught before a customer reads it.
- Work out whose response a check is reading, the firm’s own server or a provider in front of it, before anything is recorded as a finding.
- Map findings to MITRE ATT&CK techniques and to the flaws known to be exploited.
What we look for
- Deep knowledge of DNS, email authentication, TLS and HTTP as they behave in practice.
- Python, and the habit of testing your own check against cases built to break it.
- Strict about reading only what is public: nothing tested, nothing logged in to.
- You can state what a check cannot see as plainly as what it can.
Where: remote, in Canada or the United States. Start date: none fixed. To apply: a short note and one piece of your work, by email.
Write to us about this roleExposure AnalystVerify each assessment before it is released, and write every finding in plain English. Read the roleClose
What you would do
- Read every finding in an assessment against its evidence before the customer sees it.
- Hold back anything the evidence does not support, and record why.
- Write findings and fix steps an owner can follow and an IT provider can act on.
- Tell the people who write the checks where a check misled you.
What we look for
- A security background broad enough to judge evidence across email, web and DNS.
- Plain, exact writing. No alarm and no padding.
- Steady care: the last finding in an assessment gets the same reading as the first.
- You are willing to stop a release.
Where: remote, in Canada or the United States. Start date: none fixed. To apply: a short note and one piece of your work, by email.
Write to us about this rolePartnerships LeadBring the outside reading to the organisations that already look after many firms. Read the roleClose
What you would do
- Build working relationships with insurance brokers and insurers, professional networks and associations, and IT providers.
- Set up each partner’s private summary across the firms they work with, and make sure it is useful to them.
- Agree in writing what a partner sees and what stays with each member firm.
- Bring back what partners ask for, so the product answers it.
What we look for
- Experience building partner or channel relationships in insurance, professional services or IT services.
- Patience with long decisions and committees.
- Care with member data, consent and confidentiality.
- You write your own proposals and follow-ups, and they are clear.
Where: remote, in Canada or the United States. Start date: none fixed. To apply: a short note and one piece of your work, by email.
Write to us about this roleProduct EngineerBuild what the customer uses: the dashboard, the fix trail and the evidence record. Read the roleClose
What you would do
- Build in Python and Django across the customer dashboards, the outside reading and the documents that come with an assessment.
- Keep the evidence record sound: dated entries, each tied to the one before it, so a later change can be detected.
- Build the fix trail: each fix step, the re-check after it, and the record that an opening is closed.
- Prove a change on the rendered page, at desktop and phone width, before it ships.
What we look for
- Strong Python and Django, and sound judgement about data models.
- An eye for an interface a busy owner can read in one pass.
- You test what you ship and you write down what you did not test.
- Comfortable owning a feature from the model to the page.
Where: remote, in Canada or the United States. Start date: none fixed. To apply: a short note and one piece of your work, by email.
Write to us about this roleNot on the list, and sure you belong here? Write with the subject “Careers: other” and tell us the work you would take on.
Three rules every role works under.
Evidence comes before opinion.
Every finding we show carries its evidence and a check that can be run again. We hold our own claims to the same standard.
A person verifies every release.
Every paid assessment is held until a person has read it. Nothing reaches a customer on a machine’s say-so alone.
Fixed checks decide what is true.
Where AI is used, it assists. It does not decide a finding, and a failed model never stops a check from running.
One email. No form, no upload, no tracking.
- Email [email protected] with the subject “Careers:” and the name of the role, for example “Careers: Security Research Engineer”. The button inside each role fills the subject in for you.
- Write a short note: what you have done, and why this role. A few paragraphs is enough.
- Add one piece of your work: a link or an attachment. Something you made, wrote, measured or sold, and can talk about in detail.
- We reply to every serious note. There is no fixed start date and no closing day. The terms of a role are agreed with the person, in conversation, before anyone commits to anything.