Software Engineer Sandboxing

1 hour agoSalary: 300K - 350KSan Francisco; New York Onsite Full Time Devops Jobs by Thinking Machines Lab

Thinking Machines Lab

Artificial-intelligence research and product company building customizable AI systems, including the Tinker training API and Inkling open-weight models.

Seed Company intelligence

Distributed

Funding history

Strategic investmentSeed ($2B)

Investors

Nvidia Jane Street AMD Accel Andreessen Horowitz

About Thinking Machines Lab

Thinking Machines Lab develops AI products that let researchers and developers fine-tune and use models, while also releasing open-weight multimodal models.

View jobs by Thinking Machines Lab

Skills

Abuse Detection Api Cgroup Cloud Hypervisor Container Firecracker Gvisor Kata Containers Linux Microvm Namespace Networking Observability Python Resource Management Rust Sandboxing Seccomp Virtualization

Candidate Availability

Onsite · San Francisco · Required

Required and preferred rules are kept separate and reflect the wording in the original posting.

About the Role

You will design, build, and operate sandboxed environments for untrusted model-generated code and tool calls. You will improve isolation boundaries, build scheduling and lifecycle systems, instrument for observability and abuse detection, and own platform reliability and performance from APIs to virtualization.

Requirements

Bachelor's degree or equivalent experience in computer science, engineering, or a similar field.
Proficiency in a backend programming language.
Experience building or operating isolation or virtualization technology, such as containers, microVMs, or sandboxed runtimes.
Knowledge of Linux isolation internals, including namespaces, cgroups, seccomp, capabilities, and networking.
Ability to work across the stack and own projects end to end.
Experience collaborating with cross-functional partners and subject-matter experts.

Responsibilities

Design, build, and operate sandboxed execution environments for untrusted model-generated code and tool calls.
Improve isolation boundaries using containers, microVMs, or gVisor-style kernels.
Build scheduling, resource-management, and lifecycle systems for sandboxes.
Expose sandboxing primitives that are simple to use and hard to misuse.
Instrument sandboxes for observability and abuse detection and respond to exploitation attempts.
Own reliability and performance from API design to the virtualization layer.

Benefits

Health, dental, and vision benefits.
Unlimited PTO.
Paid parental leave.
Relocation support as needed.