Software Engineer, Sandboxing

Job summary

Responsibilities

Our models and agents increasingly need to run code, use tools, and take actions in the world — safely, reliably, and at scale. The Core Services team builds the sandboxing infrastructure that makes this possible: the isolated execution environments where models write and run code, browse, and…

• Design, build, and operate sandboxed execution environments for running untrusted, model-generated code and tool calls at scale.
• Improve isolation boundaries using technologies such as containers, microVMs, or gVisor-style kernels, balancing security against startup latency and throughput.
• Build the scheduling, resource-management, and lifecycle systems that provision, reuse, and tear down sandboxes efficiently under heavy concurrent load.
• Partner with researchers and Tinker's product team to expose sandboxing primitives that are simple to use and hard to misuse.
• Instrument sandboxes for observability and abuse detection, and respond to novel escape or exploitation attempts as they're discovered.

What they're looking for

• Bachelor's degree or equivalent experience in computer science, engineering, or similar.
• Proficiency in at least one backend language (we use Python or Rust).
• Experience building or operating isolation or virtualization technology, such as containers, microVMs (e.g. Firecracker, Cloud Hypervisor), or sandboxed runtimes (e.g.
• Solid grounding in Linux internals relevant to isolation: namespaces, cgroups, seccomp, capabilities, and networking.
• Comfort operating across the stack and owning projects end-to-end.

Tech stack

• Python
• Rust
• Kubernetes