The objects you're looking for are UserEntityAccess and UserFieldAccess, for object security and field security, respectively. Unfortunately, it appears that these tables are read-only, so you're still stuck with using the Metadata API, as far as I can tell.
Edit: You can now Create, Read, Update, and Delete FieldPermissions via the REST API, (note: not the Tooling API, just the normal REST API), so it is possible to automate this process as a separate step after using the Tooling API to create the field.