Software engineer, AI model supply chain and package security

About this role

We build fast, modern developer tools in Rust, and a surprising amount of serious software runs on them. Pixi, rattler and rattler-build are open source and used by hundreds of thousands of developers: quant teams in finance, physicists at CERN, biotech labs, and humanoid robot companies you've probably seen videos of. We are also core maintainers of conda-forge, one of the largest open source package ecosystems, and we maintain RoboStack, which gets ROS running on any OS from a single lockfile.

When that much software flows through your tools, security stops being optional. Every package that ends up on a laptop, a server or a robot should be traceable back to the source and build that produced it. We're building that for conda today, and we want to extend it to AI models. The engineering team is spread across Europe (Netherlands, Germany, UK, Moldova). This work is based in Berlin, and so is this role. The work Robots increasingly run learned models: vision transformers, RL policies, LLMs.

Today those models are usually copied onto machines as large opaque files, with little record of where they came from or what changed. We think models should be shipped like packages: versioned, signed, verifiable, and updated efficiently. You'll work on two related areas. Package security. Signing and verification for conda packages with Sigstore, provenance from source to build to install, SBOMs, and mapping known vulnerabilities onto the packages people actually use.

This work goes into Pixi, rattler and conda-forge, and is used by a lot of people. AI models as packages. Taking the same ideas to model artifacts. That includes: A provenance chain from training through packaging to deployment, with signatures that can be verified offline on air-gapped robots A model SBOM format, building on CycloneDX's ML-BOM Delta updates between model versions (full models, fine-tunes, LoRA adapters, quantized variants), so robots don't download gigabytes for a small change Compression that combines model techniques (quantization, pruning, distillation) with what package managers already do well (zstd, content-addressable storage), tuned to the target hardware and network Managing models that get fine-tuned on the robot itself: tracking where those variants came from, validating them, and syncing them back Testing the whole pipeline end to end on real models and real hardware, and measuring latency, bandwidth and model quality A lot of this is new.