Software engineer, AI model supply chain and package security

We build fast, modern developer tools in Rust, and a surprising amount of serious software runs on them.

Pixi, rattler and rattler-build are open source and used by hundreds of thousands of developers: quant teams in finance, physicists at CERN, biotech labs, and humanoid robot companies you've probably seen videos of.

We are also core maintainers of conda-forge, one of the largest open source package ecosystems, and we maintain RoboStack, which gets ROS running on any OS from a single lockfile.

When that much software flows through your tools, security stops being optional.

Every package that ends up on a laptop, a server or a robot should be traceable back to the source and build that produced it.

We're building that for conda today, and we want to extend it to AI models.

The engineering team is spread across Europe (Netherlands, Germany, UK, Moldova). This work is based in Berlin, and so is this role.

The work

Robots increasingly run learned models: vision transformers, RL policies, LLMs.

Today those models are usually copied onto machines as large opaque files, with little record of where they came from or what changed.

We think models should be shipped like packages: versioned, signed, verifiable, and updated efficiently.

You'll work on two related areas.

Package security.

Signing and verification for conda packages with Sigstore, provenance from source to build to install, SBOMs, and mapping known vulnerabilities onto the packages people actually use.

This work goes into Pixi, rattler and conda-forge, and is used by a lot of people.

AI models as packages. Taking the same ideas to model artifacts. That includes:

A lot of this is new. Part of the job is figuring out which approaches work, measuring them honestly, and writing up what you found.

What we're looking for

You don't need years of experience. You do need solid fundamentals, curiosity, and the patience to get security details right.

It's a plus if you know package managers from the inside, have worked on model compression or edge inference, have robotics experience, or have contributed to open source. None of this is required.

What we offer

You'll work on problems few people have solved yet, together with the people who created Mamba, Pixi, rattler and RoboStack.

Most of your work will be open source and used by a large community from day one.

We pay a competitive Berlin salary, with 30 days of vacation, the hardware you want, a conference budget, and time for upstream open source work.

We help with relocation within the EU.

Find more English Speaking Jobs in Germany on Arbeitnow