Careers at Teramis

About the Role

We are looking for a Python Developer to join the Teramis product engineering team. Teramis is a cybersecurity data platform purpose-built to help organizations discover and protect DoD Controlled Unclassified data across complex enterprise environments. Day to day, you will write and maintain Python-based data extractors, track down and fix bugs, validate that our code meets security standards using SAST and DAST tooling, and collaborate with the team through GitHub-based workflows.

This is a hands-on engineering role. You will write, own, debug, and defend real code. We are not looking for someone who can prompt an AI tool into producing output. We are looking for an engineer who understands what the code does, why it is structured the way it is, and what happens when it breaks.

Key Responsibilities

Required Qualifications

• 3+ years of professional Python development experience shipping production software, not academic or tutorial projects.
• Extractor or parser experience: You have built data ingestion, ETL, or parsing pipelines and can speak in detail to the design choices, failure modes, and performance characteristics of what you built.
• CS fundamentals: Solid working knowledge of data structures, including trees, graphs, queues, and hash maps, algorithm complexity (Big-O), and memory management. You can reason through a problem from first principles without looking it up.
• Debugging discipline: You use debuggers, profilers, and structured isolation to find bugs, not trial-and-error copy-paste. You can debug code you did not write.
• SAST/DAST experience: Hands-on use of at least one SAST tool, such as Bandit, Semgrep, or SonarQube, and one DAST tool, such as OWASP ZAP or Burp Suite. You can read scan output critically and distinguish genuine risk from noise.
• GitHub proficiency: Branching, pull requests, code review, resolving merge conflicts, and maintaining a clean commit history. You treat version control as part of the engineering discipline, not an afterthought.
• Working knowledge of OWASP Top 10 and CWE/SANS Top 25 vulnerability classes, sufficient to recognize them in code, not just in a scan report.
• Experience consuming REST APIs and handling authentication schemes, including OAuth 2.0, API keys, and JWT, at the code level.
• Proficiency with Python concurrency, including threading, multiprocessing, and asyncio, with an understanding of when each is appropriate.
• Working knowledge of Linux/Unix environments and shell scripting.
• U.S. citizenship or permanent residency required.

Preferred Qualifications

• Experience building data discovery, classification, or DLP tooling.
• Familiarity with file-format internals, including Office Open XML, PDF structure, and email MIME, at the byte or object level.
• Experience with cloud-native data sources, including S3, Azure Blob Storage, Google Cloud Storage, SharePoint Online, and OneDrive.
• Knowledge of containerization and writing production-ready Docker images.
• Experience with GitHub Actions for CI/CD pipeline automation, including integrating SAST scans into the build pipeline.
• Familiarity with threat-modeling approaches, including STRIDE and MITRE ATT&CK, as they relate to data pipelines.
• Relevant certifications, such as CSSLP, GWAPT, or CompTIA Security+.
• Experience with FedRAMP authorization processes or operating within a FedRAMP-authorized environment is not required but is a significant differentiator.

What to Expect in Our Interview Process

Our process is designed to assess real engineering ability. We do not rely solely on behavioral interviews or take-home projects that can be outsourced. Expect the following:

1. Technical screen: A live conversation about your past work, with detailed questions about extractors or parsers you have built and the decisions behind them.
2. Live coding exercise: Conducted in a shared editor without AI tools. You will write Python, walk through it verbally, and debug a provided code sample.
3. SAST/DAST exercise: You will be given scan output from a real tool and asked to evaluate the findings, identify which represent genuine risk, and describe how you would remediate them.
4. Code review exercise: You will review a Python code sample and provide substantive feedback on correctness, security weaknesses, and maintainability.

Candidates who can speak fluently to what they have built, why it is designed the way it is, and how they would change it today will do well. Candidates who cannot explain code they claim to have written will not advance.

Work Environment & Expectations

• Fully remote. Candidates must be based in the United States.
• Must maintain a secure, dedicated workspace.
• All work is performed under NDA. Discretion and professional judgment are non-negotiable.

Equal Opportunity Employer

We are an equal opportunity employer committed to building a diverse team. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.