Senior Security Software Engineer (Sandbox Platforms)
Posted Updated
Description
- We build the isolation layers that contain untrusted and semi-trusted code
- You will design, build, and harden process sandboxes across one or more of Linux, macOS, and Windows, the last line of defense when something inside goes wrong
- This is a deep systems role for someone who thinks in terms of attack surface, threat models, and the exact boundary between trusted and untrusted
- Design and implement sandboxes using platform primitives: nsjail, seccomp-bpf, namespaces, cgroups, and Landlock on Linux; the Seatbelt (sandbox_init / SBPL) and related mechanisms on macOS; AppContainer, job objects, restricted tokens, and integrity levels on Windows
- Define and lock down every communication path in and out of the sandbox: syscalls, IPC, shared memory, file descriptors, sockets, brokers, and minimize what each one exposes
- Enumerate and reduce attack surface: kernel syscall surface, broker interfaces, device access, and side channels
- Assume the code inside is hostile
- Make deliberate engineering tradeoffs between isolation strength, performance, compatibility, and maintainability, and document the reasoning
- Write threat models, review designs, and respond to sandbox escapes and hardening findings
- Deep, hands-on knowledge of the OS security model on at least one of Linux, macOS, or Windows, and the sandboxing primitives that platform provides
- Fluency in the boundary between sandbox and host (brokers, IPC, syscall filtering, privilege separation) and how to design a minimal, well-audited interface
- Systems programming in C, C++, or Rust; comfort at the syscall and kernel-interface level
- A security mindset: you default to least privilege and distrust every input crossing the boundary
- Sound judgment on tradeoffs: knowing when tighter isolation is worth the cost and when it isn’t
- Strong grasp of attack surface analysis: how sandboxes are escaped and how to shrink the ways in
- Kernel, hypervisor, or low-level OS internals work
- Experience across more than one of the three platforms
- Fuzzing, exploit development, or red-team experience against isolation boundaries