Software engineer, AI model supply chain and package security

We build fast, modern developer tools in Rust, and a surprising amount of serious software runs on them. Pixi, rattler and rattler-build are open source and used by hundreds of thousands of developers: quant teams in finance, physicists at CERN, biotech labs, and humanoid robot companies you've probably seen videos of. We are also core maintainers of conda-forge, one of the largest open source package ecosystems, and we maintain RoboStack, which gets ROS running on any OS from a single lockfile.

When that much software flows through your tools, security stops being optional. Every package that ends up on a laptop, a server or a robot should be traceable back to the source and build that produced it. We're building that for conda today, and we want to extend it to AI models.

The engineering team is spread across Europe (Netherlands, Germany, UK, Moldova). This work is based in Berlin, and so is this role.

The work

Robots increasingly run learned models: vision transformers, RL policies, LLMs. Today those models are usually copied onto machines as large opaque files, with little record of where they came from or what changed. We think models should be shipped like packages: versioned, signed, verifiable, and updated efficiently.

You'll work on two related areas.

Package security. Signing and verification for conda packages with Sigstore, provenance from source to build to install, SBOMs, and mapping known vulnerabilities onto the packages people actually use. This work goes into Pixi, rattler and conda-forge, and is used by a lot of people.

AI models as packages. Taking the same ideas to model artifacts. That includes:

• A provenance chain from training through packaging to deployment, with signatures that can be verified offline on air-gapped robots
• A model SBOM format, building on CycloneDX's ML-BOM
• Delta updates between model versions (full models, fine-tunes, LoRA adapters, quantized variants), so robots don't download gigabytes for a small change
• Compression that combines model techniques (quantization, pruning, distillation) with what package managers already do well (zstd, content-addressable storage), tuned to the target hardware and network
• Managing models that get fine-tuned on the robot itself: tracking where those variants came from, validating them, and syncing them back
• Testing the whole pipeline end to end on real models and real hardware, and measuring latency, bandwidth and model quality

A lot of this is new. Part of the job is figuring out which approaches work, measuring them honestly, and writing up what you found.

What we're looking for

You don't need years of experience. You do need solid fundamentals, curiosity, and the patience to get security details right.

• Rust, or a strong background in C++, Go or Python and the wish to switch
• Interest in software supply chain security. Bonus if you've worked with Sigstore (Cosign, Rekor, Fulcio), TUF, in-toto, SLSA or SBOM formats
• Familiarity with ML in practice: you've trained or fine-tuned a model, know what a LoRA adapter or a quantized model is, and have used PyTorch or similar
• Basic understanding of cryptography as an engineer: signatures, hashes, certificates, and what they do and don't guarantee
• You like measuring things and are honest about results that don't work out
• You live in Berlin or are willing to move here

It's a plus if you know package managers from the inside, have worked on model compression or edge inference, have robotics experience, or have contributed to open source. None of this is required.

What we offer

You'll work on problems few people have solved yet, together with the people who created Mamba, Pixi, rattler and RoboStack. Most of your work will be open source and used by a large community from day one. We pay a competitive Berlin salary, with 30 days of vacation, the hardware you want, a conference budget, and time for upstream open source work. We help with relocation within the EU.