alexchantavy

Subimage (YC W25) | Founding Engineer | San Francisco, CA | ONSITE (5 days/week) | Full-time | $170K–$230K + 0.5%–1.0% equity | https://subimage.io

Hihi, I'm Alex, co-founder and CEO. Subimage maps infrastructure the way an attacker does so security teams at scale-ups and enterprises can find and fix problems. We're built on Cartography (https://cartography.dev), the open source infra mapping tool we helped create at Lyft and donated to the CNCF. It runs at over 70 companies, including 7 in the Fortune 100.

We're a tiny seed-stage team and our customers are companies your parents have heard of. We have more demand than we can build for, which is why this post exists. This is a chance to get in on the ground floor of something big (or to find out quickly that it won't work; just being upfront about it).

Some of the problems you'd be working on:

- Vulnerability triage with real context: is the asset internet-facing, through which services, is the vulnerable function actually reachable in code, are there compensating controls, and what sensitive data does it reach once exploited, across how many hops.

- Proving that the security fixes our agent proposes won't break anything.

- A near-real-time, self-updating map of an environment so you can see an attack as it happens, plus "time travel" in the graph so you can replay it afterward.

- Teaching an agent to answer questions about a large graph quickly, with only the context it needs and without making mistakes.

- Determining who owns a given resource from messy signals like tags, actions, logs, and files.

Stack: Cartography for ingestion, Neo4j for the graph, Python/FastAPI backend, Svelte frontend with a homegrown WebGL graph renderer, an MCP server that exposes all of it to agents, Terraform for IaC.

Who we're looking for: 3+ years at high-growth companies, strong distributed systems and cloud experience, a real sense of ownership, first-principles thinking, and a willingness to implement gnarly business logic (elegantly, ideally) if it makes a jaded security engineer's life easier. Kubernetes and security knowledge are nice to have, not required. You're in the Bay Area and want to be in the office five days a week.

Process: technical screen, call with the founders, a paid day working with the team, then offer. Health/vision/dental, 401k match, gym, team lunches, unlimited PTO.

Apply here and mention HN: https://www.ycombinator.com/companies/subimage/jobs/NCTFgKK-...

Brought me back to my childhood and reminded me of this tunnel-hold-breath bit: https://www.youtube.com/watch?v=DTqjq5sWkpQ

And the eyebrows have eyebrows

I like the concept of deontological ethics where instead of just plain good and bad, we consider what is one’s duty. People make decisions based on who they are responsible for.

First thing I thought of too, I love it

How many tok/s are you getting? What gen mbp?

Prompting and having the model fill out the rest makes it feel like jazz or at least an improvised result of a song

It has to be Old Ebbitt Grill

Pressure test

> my parents thought it was much more serious than it was

How'd it end up? I'm wondering why it ended up actually less serious

> PlayStation users are moving to PC en masse

PC is even more digital-only than Playstation. No one buys physical games on PC. The only difference is that Valve has been a very good steward over Steam. Theoretically, PC can get as enshittified as PS.

I guess there are other DRM-based purchasing platforms, and there's also DRM free ones like GOG so PC gamers have choice, but those feel niche mostly.

Voice really matters in writing. If everyone uses Opus to write without editing, then it all sounds the same regardless of who it came from.

I miss that 2010s startup look

High, extra, or max?

The problem they're trying to solve is to find out what functions of their software are most useful for people and what to invest in, and to make directions on product direction.

Yes, vendors can, do, and should talk to users, but then a lot of users don't like receiving cold messages from vendors (and some users go so far as to say that cold messages should _never_ be sent).

So, the alternative is to collect some soft telemetry to get usage metrics. As long as a company is upfront about it and provides an opt-out mechanism, I don't see a problem with it. Software projects (and the businesses around them) die if they don't make the right decisions.

As an open source author and maintainer, I very rarely hear from my users unless I put in the legwork to reach out to them so I completely identify with this.

Great article, thanks for sharing. How much does it run you a month roughly?

> You could look at your denigrators and decide: "fuck you"

That escalated quickly and I enjoyed this comment a lot

I wonder what college freshman-level writing classes are teaching about writing voice and AI. The tell-tale patterns are pretty frustrating to read.

The solution to every software problem is another layer of indirection :-)

I sure hope so. The way companies are pressured to hit growth numbers, I really hope messaging in general doesn’t all get sloppified along with code lol.

I think AI writing makes humanities and writing courses more important, and I hope people maintain their sense of taste with writing, but tbh I’m not optimistic here.

My favorite part is how pg says how kids made him less ambitious, but then:

“On the other hand, what kind of wimpy ambition do you have if it won't survive having kids? Do you have so little to spare?”

Relevancy is a big point here. HN readers work in tech or are super interested in tech, YC companies do very technical things so hiring posts or launches tend to blend right in for the most part.

I think this overstates the “betrayal” angle.

A lot of great open source comes out of startups because startups are really good at shipping fast and getting distribution (open source is part of this strategy). Users can try the tool immediately, and VC funding can put a lot of talent behind building something great very quickly.

The startup model absolutely creates incentive risk, but that’s true of any project that becomes important while depending on a relatively small set of maintainers or funders.

I’m not sure an acquisition is categorically different from a maintainer eventually moving on or burning out. In all of those cases, users who depend on the project take on some risk. That’s not unique to startups; it’s true of basically any software that becomes important.

There’s no perfect structure for open source here - public funding, nonprofit support, and startups all suck in their own ways.

And on the point you make about public funding being slow: yeah, talented people can’t work full-time on important things unless there’s serious funding behind it. uv got as good as it is because the funding let exceptional people work on it full-time with a level of intensity that public funding usually does not.

Seems like in this new AI world that the word sandbox is used to describe a system that asks "are you sure".

I'm used to a different usage of that word: from malware analysis, a sandbox is a contained system that is difficult to impossible to break out of so that the malware can be observed safely.

Applying this to AI, I think there are many companies trying to build technical boundaries stronger than just "are you sure" prompts. Interesting space to watch.

Haha FB Cloud sounds so wild to imagine