Ruleforge (Detection Engineering Startup backed by TryHackMe)

SOC teams everywhere are drowning in noise. They’re buried in alerts, chasing false positives, and wasting precious time that should be spent stopping real attackers. The biggest choke point? Detection rules. Done badly, they kill efficiency. Done well, they unlock SOCs to focus on threats that matter.

We’re building Ruleforge to fix this problem — and we’re looking for a Founding Engineer to help us make it happen. Backed by TryHackMe (900+ companies, 5M+ users), you’ll be building with brand, distribution, and credibility from day one.

Why this is different

• Be the first – You won’t be engineer #27, you’ll be the engineer that writes the first lines of code and shapes the entire technical DNA.

• Speed & intensity – We’ll be shipping constantly, validating with real SOC teams, and iterating daily.

• Unfair advantage – TryHackMe already reaches millions of practitioners and hundreds of companies. Ruleforge will be built for them, with them.

What’s in it for you

• Equity & ownership – A real stake in building something from zero.

• Technical leadership – Autonomy to choose the stack, set the standards, and grow into CTO if you want it.

• Career-defining challenge – You’ll be part of a founding team solving one of security’s hardest problems.

• Backed but independent – Build fast with the support of a profitable global company behind you.

What you’ll do

• Product Development: Build, test, and deploy the MVP, ensuring it solves core customer problems.

• Technical Ownership: Make decisions on languages, frameworks, infrastructure, and architecture.

• Iteration & Validation: Ship fast, learn from customer feedback, and continuously improve.

• Leadership & Culture: Help shape Ruleforge’s engineering culture and technical direction.

Who we’re looking for

• All-in builder – You thrive in messy, ambiguous environments and want to create from scratch.

• Proven engineer – Strong full-stack and infrastructure fundamentals (Python/Go/Node; AWS/GCP/Azure; distributed systems).

• 0→1 experience – You’ve shipped real products, ideally in a startup or high-pressure environment.

• Security curious – Exposure to SIEMs, detection rules, or SOC workflows is a plus (but not required).

• Customer-minded – Comfortable engaging with users, and translating feedback into technical solutions.

• Founder pace – Ready to work harder than you’ve ever worked before — with the upside to match.

What the journey looks like

• Short term – Build and ship the MVP, get it into SOC teams’ hands, and iterate fast.

• Mid term – Scale the product, bring in the next wave of engineers, and shape our engineering culture.

• Long term – Define the technical vision as Ruleforge becomes the detection backbone for SOCs everywhere.

Why now

SOC teams need help — attackers are moving faster, analysts are burning out, and the current tools aren’t keeping up. With our reach, brand, and conviction, this is a once-in-a-lifetime shot to build something that truly changes how defenders work.

You’ll get equity, autonomy, and the chance to be the engineer who shapes a company from day one — backed by one of the fastest-growing cybersecurity training companies in the world.