Senior Security Software Engineer, Sandbox Platforms

Overview

Design, build, and harden process sandboxes that isolate untrusted and semi-trusted code across one or more of Linux, macOS, and Windows, serving as the last line of defense when code inside a sandbox misbehaves.

What you'll do

• Design and implement sandboxes using platform primitives: nsjail, seccomp-bpf, namespaces, cgroups, and Landlock on Linux; the Seatbelt (sandbox_init / SBPL) and related mechanisms on macOS; AppContainer, job objects, restricted tokens, and integrity levels on Windows.
• Define and lock down every communication path in and out of the sandbox: syscalls, IPC, shared memory, file descriptors, sockets, and brokers, minimizing what each one exposes.
• Enumerate and reduce attack surface: kernel syscall surface, broker interfaces, device access, and side channels.
• Assume the code inside is hostile.
• Make deliberate engineering tradeoffs between isolation strength, performance, compatibility, and maintainability, and document the reasoning.
• Write threat models, review designs, and respond to sandbox escapes and hardening findings.

What you'll need

• Deep, hands-on knowledge of the OS security model on at least one of Linux, macOS, or Windows, and the sandboxing primitives that platform provides.
• Strong grasp of attack surface analysis: how sandboxes are escaped and how to shrink the ways in.
• Fluency in the boundary between sandbox and host (brokers, IPC, syscall filtering, privilege separation) and how to design a minimal, well-audited interface.
• Systems programming in C, C++, or Rust; comfort at the syscall and kernel-interface level.
• Sound judgment on tradeoffs: knowing when tighter isolation is worth the cost and when it isn't.
• A security mindset: you default to least privilege and distrust every input crossing the boundary.

Nice to have

• Experience across more than one of the three platforms.
• Kernel, hypervisor, or low-level OS internals work.
• Fuzzing, exploit development, or red-team experience against isolation boundaries.

Details

• Location: San Mateo, CA, United States (headquarters).
• Onsite Tuesday, Wednesday, and Thursday, with optional presence on Monday and Friday.
• Annual base salary range: $269,170 to $326,060 USD. Actual base pay depends on factors such as professional background, training, work experience, location, business needs and market demand.
• Full-time employees are also eligible for equity compensation and benefits.
• For US-based roles only: the Company may not be able to employ candidates who have United States work authorization related to certain U.S. visa categories, or support future H-1B sponsorship at this time.