Machine Learning Engineer — Applied AI & Agents

About the role

Build the learning systems behind security agents

At Cotool, we're building AI agents and the infrastructure around them to help security teams detect threats, investigate alerts, and respond. Our agents work across security tools and data, write and tune Python detections, and bring humans in when judgment or approval matters. Teams at Ramp, EliseAI, and ClickHouse use Cotool.

We're hiring a machine learning engineer to build the loop from agent behavior to training data, from training data to better models, and from better models to measurable improvements in production. You'll work across post-training, RL environments, evaluation, and deployment, with direct ownership of what reaches users.

What you'll build

• LLM fine-tuning pipelines. Curate and version datasets, turn useful trajectories and failure cases into training examples, run post-training experiments, and evaluate generalization on held-out tasks.
• RL environments for security work. Build reproducible tasks with realistic tool interfaces, observations, state transitions, and verifiable outcomes. Design rewards that encourage successful investigations and catch shortcuts, reward hacking, and brittle behavior.
• Agent evaluations. Measure multi-step task completion, tool use, evidence quality, and failure recovery. Use baselines and ablations to distinguish model improvements from changes to the harness or context layer.
• Production model systems. Take models from experiment to serving: versioning, inference performance, rollout, monitoring, and rollback. Own the tradeoffs between quality, latency, and cost.
• The interface between model and harness. Work with the engineering team on context assembly, memory, compaction, and tool design. Decide which failures need better training, better context, or a change to the execution loop.

A project might start with agents repeatedly failing a particular class of investigation. You'd reproduce the failure, build an environment and evaluation around it, test a training approach, and deploy the improvement. Success means the agent performs better on new investigations under production constraints.

What we're looking for

• You've fine-tuned LLMs before. You've worked directly on data preparation, training, and evaluation, and can explain what improved, what didn't, and why.
• You've built RL environments. You have hands-on experience defining tasks, observations, actions, rewards, and episode completion, and debugging the behavior those choices produce.
• You've deployed ML models to production. You've taken responsibility for serving and operating a model used by real users or systems, including monitoring and reliability.
• Strong Python and ML engineering fundamentals, with practical experience in a deep learning framework such as PyTorch. You can move between training code, data pipelines, experiments, and production software.
• Good experimental judgment. You question the metric, inspect the data, investigate regressions, and know when a simpler approach is the right one.

Experience with tool-using agents, LLM post-training with RL, synthetic data, or security systems is especially relevant. We care about what you've built and can demonstrate. Bring an example of a training run, environment, or production deployment you owned, including the failures and tradeoffs.

The platform and team

Our platform uses TypeScript, React, Node.js, Python, PostgreSQL, ClickHouse, and Redis, with AI SDK for model integration and Braintrust for tracing and observability. You'll help shape the training and inference stack around the needs of the product.

We're a small team in San Francisco backed by Andreessen Horowitz, WndrCo, Y Combinator, and Homebrew. You'll work closely with the founders and the engineers building our agent runtime. We offer competitive salary and equity, healthcare, dental and vision coverage, and an unlimited token budget.

If you want to close the loop between training an agent and watching it solve a real problem, we'd like to meet you.

About Cotool

Cotool builds AI agents and the security infrastructure they need to help cybersecurity teams keep up with attackers. Our mission is to scale defensive security with tokens: give security teams more capacity to detect threats, investigate alerts, and respond without growing headcount for every new workload.

Our platform brings together log search, detections written in code, automated investigations, response, and threat hunting. Agents work across a team's existing tools and data, with practitioners able to inspect the evidence, edit the logic, and decide where human approval belongs. Teams at Ramp, EliseAI, and ClickHouse use Cotool.

We're a small team in San Francisco backed by Andreessen Horowitz, WndrCo, Y Combinator, and Homebrew. We're hiring a generalist software engineer who wants to own problems from the first customer conversation through production. The work spans product interfaces, backend systems, agent behavior, and data infrastructure. You'll help decide what to build and carry it across the finish line.

If you enjoy learning unfamiliar domains, making thoughtful tradeoffs, and shipping tools that people rely on for real work, we'd love to meet you.