Senior backend engineer · Orlando, FL · Remote

I build backend systems that take action.

Event pipelines, integrations, and automated response for security products. Early engineer at a SOAR startup, lead engineer after its acquisition by Arctic Wolf, and now on the backend of Reveal Security's identity threat detection platform. Two patents pending. Co-founder of ParsePilot.

Resume LinkedIn
Now

Reveal Security, where a login is the beginning of the story, not the end.

Principal Data Engineer Aug 2025 – present
Small team, backend and integrations
TypeScript · PostgreSQL · SQL

Reveal watches what identities do after they authenticate, across SaaS and cloud apps, for people and for service accounts and agents. I joined when the former Revelstoke CTO recruited me onto the early engineering team.

I architected and built the event-driven pipeline that carries every customer identity event from ingestion, through behavioral anomaly detection, to automated response. The integrations that feed it and the actions it triggers are mine too.

Trust Budget: every identity has a budget of trust. Anomalous behavior spends it. Cross a threshold and the platform contains the account on its own.

Trust Budget was my idea and my implementation, and it's one of the two patents pending below. It turns a stream of maybes into a decision the system can act on without waiting for an analyst.

Founding work

Two products, built with one other engineer, on nights and weekends.

ParsePilot

Beta · onboarding first design partner
Co-founder & engineer · 2025 – present

A white-label platform for agencies and MSPs. Build an AI workflow once, deploy it to every client from one cockpit, and resell it under your own brand. Each client gets an isolated workspace with its own encryption boundary, audit trail, and human-in-the-loop approvals.

Otto is the part I like most: an LLM agent that drafts an executable workflow from a plain-language description. Workflows are data, a JSON node graph run by a sandboxed interpreter, which is what makes "patch it once, push it to all clients" possible.

Node.jsExpressBullMQRedisSupabase Postgres Next.jsTypeScriptDockerRailway
parsepilot.ai ↗ · 30-person waitlist

Scribe

Working prototype
Co-founder & engineer · 2026

A fact checker that listens to a live conversation and stays quiet unless something stated as fact doesn't hold up. Every flag carries the disputed quote, an accuracy score, the correction, linked sources, and a confidence level. Built with debates, podcasts, and interviews in mind.

Short audio segments go to Deepgram for transcription, a fast Claude pass extracts check-worthy claims, and a second pass researches each one with web search and renders a verdict. The same engine is exposed over REST and as an MCP server.

Expo / React NativeExpressPostgreSQLDeepgramClaudeMCP
Private repo · ask me for a demo
Patents pending

Two filings from Reveal Security, 2026.

Trust Budget
Lead inventor

Per-identity trust scoring for the post-login world. Behavioral anomalies draw down a budget; thresholds trigger containment and remediation automatically. It replaces "alert and hope someone looks" with a decision the platform can make itself.

Correlations
Co-inventor

Detection analytics written in SQL that correlate identity events across time and sources to surface patterns a single event can't show: impossible travel, privilege escalation, and their relatives.

Path

QA engineer to lead engineer in three years, through a startup, an acquisition, and a scale-up.

Open a row for the specifics.

2025 – present Reveal SecurityPrincipal Data Engineer Recruited by former Revelstoke CTO
  • Architected and built the TypeScript event-driven pipeline that processes all customer identity events, from ingestion through behavioral anomaly detection to automated response.
  • Invented Trust Budget, the platform's approach to turning detections into automated response. Patent pending, lead inventor.
  • Co-inventor on Correlations, SQL detection analytics that correlate identity events over time. Patent pending.
  • Build and maintain the integrations that pull activity from SaaS, cloud, and identity providers and push response actions back into customers' security stacks.
2023 – 2025 Arctic Wolf NetworksAssociate → Software Engineer → Senior → Lead Software Engineer Promoted three times in 18 months
Lead Software Engineer · May – Aug 2025
  • Led the Active Response / Integrations team: the full integration catalog inherited from Revelstoke, the roadmap for new response actions, and architecture and planning for cross-team initiatives.
Senior Software Engineer · Nov 2024 – May 2025
  • Designed and led delivery of multiple customer-facing Active Response features in under a year, turning ambiguous asks into scoped specs and cutting operational cost for the SOC (Node.js, Hasura, GraphQL).
Software Engineer · Nov 2023 – Nov 2024
  • Integrated the acquired Revelstoke SOAR platform into Arctic Wolf's security operations stack with Node.js, Go, Hasura, and GraphQL, enabling automated response actions for Arctic Wolf customers.
2022 – 2023 Revelstoke SecurityQA Engineer → Integrations Engineer → Full Stack Engineer Acquired by Arctic Wolf
  • Early engineering hire at a SOAR startup. Built automation features and security-platform integrations with Vue.js, Node.js, Docker, Hasura, and GraphQL.
  • Helped ship 80+ production integrations in under two years, a major factor in the acquisition by Arctic Wolf.
  • Promoted three times in 20 months.
2020 – 2022 MedtronicConfiguration Assurance Analyst Minneapolis
  • Ran change control for regulated marketing materials, coordinating approvals across marketing, engineering, regulatory affairs, and clinical teams.
2020 University of Wisconsin – River FallsB.S. Physics, computational emphasis · Mathematics minor Sigma Pi Sigma
  • Capstone: analyzed data from four South Pole particle detectors to determine the energy spectrum during the September 2017 solar events, which included a coronal mass ejection and an X-class flare.
  • Programming intern analyzing IceCube Neutrino Observatory data in Python; REU intern building a Cherenkov muon detector for the IceCube expansion.
How I work

Physics first, then code.

Languages TypeScript, JavaScript / Node.js, Python, Go, SQL, C
Backend Event-driven systems, REST, GraphQL, Hasura, PostgreSQL
Infra AWS, Docker, Kubernetes, Linux
Security SOAR, automated response, identity threat detection

I trained as a physicist, and the habit stuck: strip a problem down to what governs it, then build the solution up from there instead of pattern-matching to the last thing that worked. Trust Budget came from asking what a security system should actually do with a stream of weak signals, not from looking at how other products handled alerts.

I like small teams and high ownership, and I like systems where the code has to be right because it's taking real actions on real accounts. Give me the fuzzy version of the problem and I'll bring back the architecture, the code, and the thing running in production.

If you're building something that has to act, let's talk.

Emailmboettner10@gmail.com
LinkedInlinkedin.com/in/maddy-boettner-249157127
ResumePDF, one page
Based inOrlando, FL · open to remote
Open toSenior backend and software engineering roles
Not looking forPeople management
AlsoDesign partners for ParsePilot