Software Engineer, Security Infrastructure

• Secure-by-default guardrails: Build the patterns, libraries, and secure-by-default standards (authentication, authorization, input handling, cryptography) that make whole classes of vulnerabilities hard to introduce, and review Go and Rust for security.
• Threat modeling and secure design: Partner with engineering teams on new features and architectural changes across a distributed, polyglot system, and turn the results into concrete design decisions.
• Software supply chain: Own dependency integrity, artifact signing, and build-pipeline trust. This matters especially for the self-managed and air-gapped deployments our customers run.
• Developer-facing security tooling: Extend the app sec toolchain in CI/CD - SAST, software composition analysis, secret scanning, and fuzzing - and keep it high-signal, tuning it so findings are accurate and actionable for developers rather than noise. Partner with the owning teams to drive real risks to remediation.
• Raise engineering’s security fluency: Through design reviews, documentation, and direct collaboration, help the whole org build securely by default.

• 5+ years building production software, including hands-on security ownership of a real codebase. You are a software engineer first, applying that skill to security.
• Ability to read and review either Go and/or Rust with fluency. You don’t need to have shipped both, but you should be able to reason about security in our stack from day one.
• Strong grounding in application security fundamentals: web and API vulnerability classes, authentication and authorization patterns, and applied cryptography.
• Experience with threat modeling and secure design review on non-trivial, distributed systems.
• Hands-on experience embedding security tooling (SAST, SCA, secret scanning) into developer workflows and CI/CD; tuning it for signal over noise.
• A bias toward building and shipping solutions that scale across teams, and toward driving their adoption. Comfortable picking up an existing security baseline and pushing it forward rather than needing to start from zero.
• Clear communication with engineers and leadership. You can explain risk and tradeoffs to people who don’t live in security.

Bonus Points:

• Experience securing software that ships to customer-controlled, on-premise, or air-gapped environments.
• Familiarity with software supply chain tooling and standards (Sigstore, SLSA, SBOM generation).
• Background with Rust memory-safety considerations, or with fuzzing native and high-throughput data paths.
• Container image and build-time security (image scanning, minimal/hardened base images).
• Familiarity with DAST or dynamic testing approaches.
• Exposure to regulated environments (defense, aerospace, or similar).

Sift is the data infrastructure platform for hardware engineering teams. We turn high-frequency telemetry into engineering insights for mission-critical machines: rockets, satellites, autonomous vehicles, energy systems, and defense platforms. Founded by former SpaceX engineers, we are building the review and analysis layer for the AI era of physical systems.