About us

Truffle Security is a cybersecurity company on a mission to make secrets easier to detect, verify, and remediate across modern software environments. Built on the popular open-source TruffleHog™ secrets scanning platform, the company's enterprise solution gives security and engineering teams everything they need to find exposed credentials, understand which ones are active, and act on them with confidence.

With support for 800+ credential types, Truffle Security continuously monitors non-human identities (NHIs) and their associated secrets across code repositories, SaaS applications, wikis, and cloud systems. It goes beyond detection by verifying which secrets are live, analyzing their scope of access, and streamlining remediation through automated workflows and lifecycle management so teams can prioritize what to revoke and confirm it's done without manual follow-up.

Trusted by organizations including NVIDIA, Chick-fil-A, and OpenAI, Truffle Security helps security and engineering teams stay ahead of secrets risk.

About the role

This is our first dedicated Revenue Operations leadership hire, and we're going to be honest about what you're walking into.

Our GTM systems and processes work, but they were built reactively as the business grew. There is not yet a cohesive, intentional revenue operations architecture, and that's exactly what we're hiring you to create.

That's the opportunity. You'll own the full GTM operations stack, define what RevOps means at Truffle, and build the function from a strong revenue base rather than a blank page. You'll inherit one Business Systems team member, hire a planned GTM Engineer, and grow the team as the business scales, including standing up functions like deal desk that don't exist today.

We're open on level. Depending on your experience, this role could be Director or VP scope. What matters is that you've built before and want to build again.

What you'll be working on

Systems foundation. Your first-year priority. Assess our Salesforce instance and strengthen it into a coherent architecture with clean data, clear definitions, and reporting people actually trust, then bring the surrounding GTM stack into alignment with it.
Full GTM operations. Sales ops, marketing ops, and CS ops under one roof. You'll be the connective tissue across the entire revenue funnel, from lead attribution through renewal.
Revenue data integrity. One architecture across the stack where records move without corruption, business definitions are enforced in-system, and any number pulled by marketing, sales, finance, or the board reconciles with every other system. When a number is questioned, you are the answer.
Deal desk and quoting. Build the function from scratch and own it directly: pricing approvals, quote-to-close workflow, non-standard deal governance, and the guardrails that let AEs move fast without breaking things. At our size this is a process you run, not a team you inherit, with the option to staff it as deal volume grows.
Marketing operations infrastructure. Marketing leadership defines the strategy, the programs, and what qualifies as a lead. You own the machinery underneath: the infrastructure that captures, enriches, routes, and nurtures every lead marketing generates, and the measurement layer that ties program spend to pipeline.
Compensation design. Own comp plan design and modeling across sales and SDR functions. You'll partner with Finance, who owns administration and payout.
Forecasting. Own forecast methodology, cadence, and tooling. Build a forecast that sales leadership and the board trust, and run the operating rhythm behind it.
Annual planning. Territory design, capacity planning, and quota setting in partnership with sales leadership and Finance.
The GTM tech stack. Full ownership: vendor selection, contracts, budget, and consolidation. If a tool isn't earning its keep, you have the authority to kill it.
Process and definitions. Codify the rules of engagement: lead routing, sourcing attribution, opportunity stages, SQL definitions, forecast methodology. Turn tribal knowledge into a documented, enforced process.
Team building. Manage and develop our current Business Systems team member, with a GTM Engineer hire planned for this team to build automation and AI-driven workflows across the stack. You'll shape that role, make the hire, and grow the function from there.

What success looks like in year one

Salesforce runs on an intentional data model. There is one source of truth: marketing, sales, and finance pull the same numbers and get the same answers
Deal desk exists, with documented approval workflows and pricing guardrails in active use.
Lead routing, sourcing credit, and qualification definitions are codified and enforced in-system.
A forecast methodology is in place and holding up against actuals, with a weekly operating cadence around it.
Comp plans are designed, modeled, and documented, with a clean handoff to Finance for administration.
Sales leadership spends its time selling and coaching, not reconciling spreadsheets.

Our fiscal year starts February 1, so annual planning is an early deliverable, not a year-end one.

What we're looking for

6+ years in revenue operations, sales operations, or GTM operations at B2B SaaS companies, with at least 2 years leading the function or a significant piece of it
Deep, hands-on Salesforce expertise. You've taken an inherited instance and meaningfully improved its architecture, data quality, and reporting, not just administered it
You've owned the full architecture across a marketing automation platform and a CRM at a company that scaled, and made the two behave as one system. Our stack: Salesforce, HubSpot, Clay, Common Room, Nooks, Gong
Experience standing up net-new functions (deal desk, marketing ops, CS ops) rather than inheriting mature ones
Comp plan design and modeling experience across AE and SDR roles
Experience owning forecast methodology and annual planning (territories, capacity, quotas) at a growing sales org
Strong analytical chops. You're fluent in pipeline math, conversion analysis, and forecast methodology, and you can defend your numbers to a CEO and a board
Comfort operating in ambiguity at an early-stage company. You'll set the strategy and do the work, especially early

Bonus points!

Experience in security, developer tools, or open source-driven companies
Experience turning open-source adoption signals into an enterprise revenue process. Our funnel starts with hundreds of thousands of daily open source users.
Experience supporting channel and partner sales models
Exposure to usage-based or seat-based pricing model transitions

Why this role

Most RevOps leaders inherit either a mess with no revenue or a mature machine with no room to build. This is neither. Truffle has real enterprise revenue, marquee logos, a healthy pipeline, and an executive team that knows the operations foundation needs investment and is hiring you to lead it. You'll have a mandate, a seat at the table, and a genuinely interesting business to operate.

Compensation

Salary Range: The target base salary range for this position is between $210,000 to $250,000 for candidates in the United States. Starting salary will vary based on job-related skills, knowledge, and experience. Leveling will be determined during the interview process. You may also be offered a bonus, stock options, and benefits. These salary ranges are subject to change, and we encourage candidates outside of this salary range to apply.

How we support our team

Fully remote within the U.S. – We believe opportunity shouldn’t be limited by geography. Our remote-first approach lets us hire the best people across the United States and empowers them to do their best work from wherever they are.
A culture of mentorship, equity, and psychological safety – We’re committed to fostering an environment where you can thrive, learn, and feel valued.
Competitive salary & meaningful equity – Be rewarded for your contributions with a strong compensation package and a stake in our shared success.
Flexible paid time off – We operate with a high level of autonomy and trust, giving you the flexibility to take time off as needed—no strict limits, just the expectation that you’re meeting your commitments and getting your work done.
14 paid holidays – Including Thanksgiving, Winter Break, and "Truffle Holidays" when the entire company takes a well-deserved day off together.
Comprehensive health benefits – Medical, dental, and vision coverage with 80% of premiums covered for you and your dependents.
Remote work stipend – Get set up for success with an $800 new hire stipend and $100/month to keep your workspace comfortable.
Health & wellness stipend – $1,200/year to support your physical, mental, and emotional well-being— we believe that feeling good helps you do great work.
Learning & development stipend – $2,000/year to invest in your growth, whether it’s courses, certifications, or industry conferences.
401(k) match – We match 100% of the first 6% of your contributions on every paycheck, helping you build financial security for the future.
100% remote + company off-sites – Twice a year, we come together in amazing locations like Hawaii, Cabo, and the Rocky Mountains to collaborate and connect.

We’re looking for folks who are interested in being part of the journey to make the internet more secure. The internet is for all, and we believe that diverse experiences and people from all walks of life can contribute to this mission. That said, if what we’re doing resonates with your values, we’d love to have you apply even if you don’t check all of the boxes or match the job description to a tee.

Truffle strives to promote an equitable, inclusive, and psychologically-safe workplace for all who are interested in working with us. All job applicants will be considered throughout the employment process without regard to race, color, ethnicity, religion, sex, sexual orientation, gender perception/identity, age, pregnancy or parental status, disability status, or any other basis prohibited by law. If you are an individual with disabilities and reasonable accommodation is needed throughout the interview process, or to perform essential job functions, please let your recruiter know.

Lastly, we ask that all applicants consider the opportunity to answer a few voluntary demographic questions on the job application. This helps us track the inclusivity of our recruiting initiatives. Answering these questions is entirely optional and your answers will not be shared with the hiring team and will not impact the hiring decision.

Note: Our organization participates in the US federal E-Verify program. We will provide the Social Security Administration, and if necessary, the Department of Homeland Security, with information from each new employee’s Form I-9 to confirm work authorization. We do not use this information to pre-screen job applicants.

About the company

TruffleSecurity develops cybersecurity tooling focused on protecting sensitive data. Its flagship product, TruffleHog, scans codebases, version histories, and other hidden content to locate exposed credentials across an organization. The open-source engine checks more than 700 credential types against the key provider, which reduces false positives and speeds up accurate detection. It also automates the remediation of discovered secrets to shorten response time. Compared with competitors, TruffleHog’s open-source nature, broad credential type coverage, and automated remediation set it apart, along with open integrations that support transparency and collaboration. The company's goal is to help organizations discover and secure leaked or stored secrets quickly, lowering the risk of credential theft and data breaches across various industries and business sizes.

Company Size

51-200

Company Stage

Series B

Total Funding

$40M

Headquarters

San Francisco, California

Founded

2019

Get referred to Truffle Security

See people who can refer or advise you

Simplify's Take

What believers are saying

Truffle Security launched AWS Analyze on August 24, 2026 for faster remediation.
Its research verified 64,024 leaked AWS keys; 88% remained active.
The 2025 $25 million round from a16z and Intel Capital funds expansion.

What critics are saying

GitHub and GitLab ship native secret scanning, compressing TruffleSecurity's pricing power.
AWS quarantine flagged 929 keys; customers still ignored alerts for years.
If enterprise buyers adopt platform-bundled scanning, TruffleHog's paid layer becomes commoditized by 2027.

What makes Truffle Security unique

Open-source TruffleHog verifies 800+ secret types and eliminates false positives.
AWS Analyze, launched August 2026, maps leaked keys to IAM blast radius.
TruffleHog scans deleted code, hidden content, and version history across stacks.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Remote Work Options
Flexible Paid Time Off
Paid Holidays
Comprehensive health benefits
401(k) Company Match
Health & wellness stipend
Learning & development stipend
Remote work stipend

Growth & Insights and Company News

Headcount

6 month growth

1 year growth

2 year growth

Truffle Security Co.

Sep 12th, 2026

Truffle Security raises $14 million Series A led by a16z ◆ Truffle Security Co.

Giving back to the community, and helping everyone raise the security bar through open source technology has always been at the heart of TruffleHog. In the beginning of 2021, my co-founders, Dustin Decker and Julian Dunning, and I decided to leave our full time jobs and focus 100% of our time on giving back to the community that helped make our career, specifically focus on continuing to build out TruffleHog to prevent credential leakage.

Associated Press

Aug 24th, 2026

Truffle Security launches AWS Analyze to cut remediation time on 64,024 leaked AWS credentials

Truffle Security has launched TruffleHog AWS Analyze, a new addition to its TruffleHog Enterprise platform. The tool enriches found AWS credentials to show permissions and access levels, helping security teams assess risk and prioritise responses to leaked credentials. TruffleHog Enterprise already finds and verifies leaked credentials across 800+ secret types. The new AWS Analyze feature now provides identity and access context for AWS environments, joining existing support for SaaS platforms and Google Cloud. Recent research by Truffle Security verified 64,024 unique leaked AWS keys from public sources. Of these, 88% remained active, with the median key active for five years. Amongst closely examined keys, 84% carried full administrator access. TruffleHog AWS Analyze is available now as an add-on to TruffleHog Enterprise.

TMCnet

Aug 24th, 2026

Truffle Security Launches TruffleHog AWS Analyze to Reduce Remediation Time on Leaked AWS Credentials

Truffle Security Launches TruffleHog AWS Analyze to Reduce Remediation Time on Leaked AWS Credentials TMCnet News [August 24, 2026] | / | Truffle Security Launches TruffleHog AWS Analyze to Reduce Remediation Time on Leaked AWS Credentials Truffle Security, the company that makes it easy to find, verify, and remediate secrets, today announced TruffleHog AWS Analyze, a new addition to TruffleHog Enterprise. TruffleHog AWS Analyze enriches found AWS credentials to highlight permissions and access levels, so a security team can assess the risk and prioritize its response. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20260824040923/en/ Its scanners have verified 64,024 unique AWS key pairs across 431,875 public findings. TruffleHog Enterprise already finds and verifies leaked credentials across 800+ secret types, and with TruffleHog Analyze, it can also provide identity and access context, first for SaaS platforms and Google Cloud, and now for AWS. With this addition, teams running multi-cloud environments can identify a leaked secret, understand what it can access, and prioritize remediation across all three surfaces. TruffleHog AWS Analyze shows full context for leaked keys Once an AWS credential leaks, understanding its impact can require manually piecing together identity, permissions, and IAM relationships. TruffleHog AWS Analyze does that investigation for security teams. It identifies the AWS user or role behind the credential, maps its effective permissions, and reveals which roles it can assume to gain additional access, giving responders a clearer picture of the potential blast radius. It also flags when AWS returns incomplete results, so teams know when the analysis provides only a partial view. "Agentic workflos are creating, using, and exposing AWS credentials faster than any team can track. Once a key ends up embedded in an automated process, it is copied and reused well beyond its original purpose, often persisting long after anyone remembers it exists. Identifying a leaked credential is one challenge but understanding what it can actually reach can be difficult to determine. TruffleHog AWS Analyze gives security teams that context as part of the same workflow, so they know exactly what has been exposed and fix it easily," said Dylan Ayrey, CEO and founder of Truffle Security. AWS keys are exposed frequently; fixing them lags behind AWS keys are among the most frequently leaked credentials, and many stay active long after they have been exposed. Because a single AWS key can reach compute, storage, databases, etc., a leak doesn't just expose one system, it exposes the permissions that control every other system. Truffle Security Research recently verified 64,024 unique leaked AWS keys pulled from public code, container images, and datasets, and found that 88% still were active. The median leaked key had been sitting active for five years, and only 14% had ever been rotated. Among the keys researched closely, 84% carried full administrator access, and 1 in 6 was a root key, which provides access to an AWS account. Surprisingly, 929 of these credentials had already been flagged by AWS's own compromised-key quarantine policy, some more than three years earlier and every one still authenticated. Even though AWS had detected the exposure, no one had remediated them. When TruffleHog scanned 7.6 petabytes of public AI training data on Hugging Face, it found the same exposure at scale. 3,343 live AWS keys were still live, more than 900 of which could list S3 buckets holding at least 51.7 TB of private data. "We proactively scan the Hub with TruffleHog and notify publishers by email when we find a verified secret. But an alert is only the beginning. Truffle Security's research is a reminder that a leaked key is vulnerable until someone rotates it. Showing teams the identity and access behind a credential is how you turn a notification into action," said Julien Chaumond, CTO at Hugging Face. If you publish models or datasets on Hugging Face, you will receive an email when a verified secret is detected. Users can check huggingface.co/settings/notifications to confirm those alerts are still on, and rotate rather than delete any key that has been exposed. Combined with TruffleHog Enterprise's ability to find and verify every instance of a leaked key, TruffleHog AWS Analyze adds access context teams need to remediate faster. Get TruffleHog Analyze for AWS TruffleHog AWS Analyze is available now as an add-on to TruffleHog Enterprise. - Read the blog on TruffleHog AWS Analyze - Learn more at TruffleHog AWS Analyze About Truffle Security For more information, reach out to [email protected] View source version on businesswire.com: https://www.businesswire.com/news/home/20260824040923/en/ [ Back To TMCnet.com's Homepage] |

Truffle Security Co.

Nov 7th, 2025

TruffleHog Analyze press release ◆ Truffle Security Co.

TruffleHog Analyze press release

SiliconANGLE Media

Nov 6th, 2025

Truffle Security secures $25M to protect codebases from leaked secrets and nonhuman identities

Truffle Security secures $25M to protect codebases from leaked secrets and nonhuman identities. Open-source security software company Truffle Security Co. announced today that it has raised $25 million in new funding to fuel continued growth of TruffleHog Enterprise, the company's enterprise-grade secrets detection, verification and remediation solution, and expand its development in secrets and nonhuman identities protection. Founded in 2019, Truffle Security provides paid solutions based on TruffleHog, an open-source tool that scans code repositories for exposed secrets such as application programming interface keys, tokens and passwords. the tool helps developers and security teams quickly identify and remediate leaked credentials before they can be exploited. Truffle Security's offering is focused on detecting exposed secrets, such as API keys, tokens, service-account credentials and other nonhuman identities, across codebases, cloud environments and repositories. The open-source engine supports hundreds of detectors and is designed to scan for signs of secret leakage or improper credentials being checked in. The company also offers verification and remediation where, once a secret is found, the platform helps determine whether it is active, what systems it could access and what the blast radius might be. The results give contextual insight that allows security teams and development teams to prioritize and respond quickly. Truffle Security's paid offering, TruffleHog Enterprise, provides monitoring, detection and integration into the software development lifecycle so that secrets don't become entry points for breaches. The Series A round was led by Intel Capital Corp. and a16z (Andreessen Horowitz). Joining the round were Abstract Ventures, Lytical Ventures and individual investors. Those included Casey Ellis, founder of BugCrowd Inc., as well as Emilio Escobar, chief information security officer at Datadog Inc. ,and Haroon Meer, founder and chief executive of Thinkst Applied Research Pty. Ltd. "As AI transforms how software is built, the security surface is expanding just as quickly," said Martin Casado, general partner at Andreessen Horowitz. "Truffle Security is tackling one of the most urgent challenges in this new era, which is protecting codebases from secret exposure at scale." Along with the funding, Truffle Security also announced a new GCP Analyze add-on for TruffleHog Enterprise that is designed to significantly reduce time to remediation when Google Cloud Platform secrets leak. With GCP Analyze, security teams get instant context, including what resources it can access, its inheritance and the blast radius of its permissions, instead of having to spend hours untangling identity and access management complexity. The new offering is built on top of TruffleHog Enterprise's verified secret detection, which eliminates false positives to help security teams remediate threats faster and more confidently across the software development lifecycle. Coming into the new funding round, Truffle Security had previously raised a $14 million Series A round in December 2021, according to data from Tracxn. Image: Truffle Security. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.

Truffle Security

Head of Revenue Operations

About the job